Search Issue Tracker
Fixed
Fixed in 2020.3.38f1, 2021.3.9f1, 2022.1.12f1, 2022.2.0b2, 2023.1.0a4
Votes
0
Found in
2022.1.3f1
2023.1.0a1
Issue ID
UUM-2660
Regression
No
Use-after-free crash bug in IL2CPP
If il2cpp is shutdown/restarted multiple times (such as when running LoadUnload tests) there is a use-after-free case shown here:
{code:java}
static void PopulateArrayGenericMethods(Il2CppClass* klass, uint16_t offset, const GenericArrayMethods& genericArrayMethods)
{
for (int i = 0; i < klass->interface_offsets_count; i++)
{
Il2CppClass* interfaceType = klass->interfaceOffsets[i].interfaceType;
if (!interfaceType->generic_class)
continue;
Il2CppClass* interfaceDefinition = GenericClass::GetTypeDefinition(interfaceType->generic_class);
Il2CppGenericContext context = { 0 };
context.method_inst = MetadataCache::GetGenericInst(&interfaceType->generic_class->context.class_inst->type_argv[0], 1);
for (GenericArrayMethods::const_iterator iter = genericArrayMethods.begin(); iter != genericArrayMethods.end(); ++iter)
{
Crash ==> if (iter->interfaceMethodDefinition->klass != interfaceDefinition) {code}
because {{iter->interfaceMethodDefinition}} can point to free'd memory. The memory comes from {{s_MetadataMemoryPool}} in {{MetadataAlloc.cpp}} . Method data is only setup once per run (even if il2cpp is shutdown/restarted) when {{GetArrayGenericMethodsCount()}} is run from {{static void SetupArrayMethods(Il2CppClass* arrayClass)}} . Reason it isnt rebuilt is a check for vector size here:
{code:java}
static size_t GetArrayGenericMethodsCount()
{
if (s_GenericArrayMethods.size() == 0)
CollectGenericArrayMethods(s_GenericArrayMethods);
return s_GenericArrayMethods.size();
} {code}
Steps to reproduce:
1) Setup basic checks in Application Verifier for exe built by LoadUnload test (il2cppLoadUnloadTest.exe on windows) or zero memory pointed to by {{s_MetadataMemoryPool}} in MetadataAlloc.cpp before its deleted.
2) Run VerifyIL2CPPLoadUnloadStressTest(DoNotUnloadDynamicLibrary) test in Rider/cmd line
3) Crash
All about bugs
View bugs we have successfully reproduced, and vote for the bugs you want to see fixed most urgently.
Latest issues
- Crash on GfxDeviceD3D12::AllocBottomLevelAccelerationStructure when using Raytracing
- The search icon in the "Searches" sections is blurry and inconsistent
- "RenderingCommandBuffer" error is thrown when switching to the tvOS platform
- Left side cog menu button is obstructed by the maximum Y value of the graph when editing a curve in the Particle System Curves
- "Property exceeds previous array size (64 vs 32)." warnings are thrown when switching from tvOS platform to a Standalone platform after restarting the Editor
Add comment