[3.x] Crash importing possibly empty/corrupted .wav

[rcorre]

Godot version:

3.2.2.stable.custom_build.0fe60f842

OS/device including version:

Linux 5.7.7-arch1-1

Issue description:

I tried to generate a voice clip using espeak.
There's probably something else wrong, as I hear nothing when I play back the file with mplayer.
However, this file completely crashed Godot, which isn't ideal even if it is corrupted.

Steps to reproduce:

1. Create a .wav file using espeak:

espeak "Target Acquired!" -v en-us -p 0 -s 210 -g 1 --stdout > target_acquired.wav

2. Move target_acquired.wav into a godot project directory
3. Open the project, see godot try to auto-import the wav
4. Godot crashes

Minimal reproduction project:

This includes the offending file:

example.zip

[qarmin]

Backtrace

handle_crash: Program crashed with signal 11
Dumping the backtrace. Please include this when reporting the bug on https://github.com/godotengine/godot/issues
[1] /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7f9ab316f210] (??:0)
[2] CowData<float>::resize(int) (/home/rafal/Pulpit/godot/./core/cowdata.h:303)
[3] Vector<float>::resize(int) (/home/rafal/Pulpit/godot/./core/vector.h:84)
[4] ResourceImporterWAV::import(String const&, String const&, Map<StringName, Variant, Comparator<StringName>, DefaultAllocator> const&, List<String, DefaultAllocator>*, List<String, DefaultAllocator>*, Variant*) (/home/rafal/Pulpit/godot/editor/import/resource_importer_wav.cpp:220)
[5] EditorFileSystem::_reimport_file(String const&) (/home/rafal/Pulpit/godot/editor/editor_file_system.cpp:1798)
[6] EditorFileSystem::reimport_files(Vector<String> const&) (/home/rafal/Pulpit/godot/editor/editor_file_system.cpp:1994 (discriminator 3))
[7] EditorFileSystem::_update_scan_actions() (/home/rafal/Pulpit/godot/editor/editor_file_system.cpp:592)
[8] EditorFileSystem::_notification(int) (/home/rafal/Pulpit/godot/editor/editor_file_system.cpp:1175)
[9] EditorFileSystem::_notificationv(int, bool) (/home/rafal/Pulpit/godot/editor/editor_file_system.h:108 (discriminator 14))
[10] Object::notification(int, bool) (/home/rafal/Pulpit/godot/core/object.cpp:934)
[11] SceneTree::_notify_group_pause(StringName const&, int) (/home/rafal/Pulpit/godot/scene/main/scene_tree.cpp:985)
[12] SceneTree::idle(float) (/home/rafal/Pulpit/godot/scene/main/scene_tree.cpp:525 (discriminator 3))
[13] Main::iteration() (/home/rafal/Pulpit/godot/main/main.cpp:2105)
[14] OS_X11::run() (/home/rafal/Pulpit/godot/platform/x11/os_x11.cpp:3233)
[15] godot(main+0x125) [0x14196db] (/home/rafal/Pulpit/godot/platform/x11/godot_x11.cpp:57)
[16] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f9ab31500b3] (??:0)
[17] godot(_start+0x2e) [0x14194fe] (??:?)
-- END OF BACKTRACE --
Przerwane (zrzut pamięci)

[timothyqiu]

This is because next_power_of_2 uses unsigned int, and it "overflowed".

godot/core/typedefs.h

Lines 124 to 137 in 2abe996

	static _FORCE_INLINE_ unsigned int next_power_of_2(unsigned int x) {
	if (x == 0) {
	return 0;
	}
	--x;
	x |= x >> 1;
	x |= x >> 2;
	x |= x >> 4;
	x |= x >> 8;
	x |= x >> 16;
	return ++x;
	}

The requested size is 4294959104 bytes, its next power of 2 is 4294967296 which is just outside the range of 32 bit unsigned int (4294967295). Line 136 turns 4294967295 into a 0.

Although CowData uses size_t, the target alloc size is 0, allocation skipped.

[Calinou]

I can confirm this on 3.5.1 and 4.0.beta 44c0bfc (Linux).

Backtrace on 4.0.beta 44c0bfc. This backtace is different from #71281 (comment):

================================================================
handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.0.beta.custom_build (54346e94a97d41a4a6e12a04e57b6cbc0a9bbc28)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] /lib64/libc.so.6(+0x3cb20) [0x7fe67c57fb20] (??:0)
[2] bin/godot.linuxbsd.editor.x86_64() [0x29f25b1] (/home/hugo/Documents/Git/godotengine/godot/./core/templates/cowdata.h:314)
[3] bin/godot.linuxbsd.editor.x86_64() [0x29ea002] (/home/hugo/Documents/Git/godotengine/godot/./core/templates/vector.h:91)
[4] bin/godot.linuxbsd.editor.x86_64() [0x4d991a2] (/home/hugo/Documents/Git/godotengine/godot/editor/import/resource_importer_wav.cpp:215)
[5] bin/godot.linuxbsd.editor.x86_64() [0x43dbf2e] (/home/hugo/Documents/Git/godotengine/godot/editor/editor_file_system.cpp:2006)
[6] bin/godot.linuxbsd.editor.x86_64() [0x43e1aeb] (/home/hugo/Documents/Git/godotengine/godot/editor/editor_file_system.cpp:2230 (discriminator 6))
[7] bin/godot.linuxbsd.editor.x86_64() [0x43c42b2] (/home/hugo/Documents/Git/godotengine/godot/editor/editor_file_system.cpp:689)
[8] bin/godot.linuxbsd.editor.x86_64() [0x43cb0dd] (/home/hugo/Documents/Git/godotengine/godot/editor/editor_file_system.cpp:1265)
[9] bin/godot.linuxbsd.editor.x86_64() [0x43e96a9] (/home/hugo/Documents/Git/godotengine/godot/editor/editor_file_system.h:146 (discriminator 14))
[10] bin/godot.linuxbsd.editor.x86_64() [0x9390d29] (/home/hugo/Documents/Git/godotengine/godot/core/object/object.cpp:792)
[11] bin/godot.linuxbsd.editor.x86_64() [0x59ac2e0] (/home/hugo/Documents/Git/godotengine/godot/scene/main/scene_tree.cpp:874)
[12] bin/godot.linuxbsd.editor.x86_64() [0x59a9c04] (/home/hugo/Documents/Git/godotengine/godot/scene/main/scene_tree.cpp:468)
[13] bin/godot.linuxbsd.editor.x86_64() [0x27f3cee] (/home/hugo/Documents/Git/godotengine/godot/main/main.cpp:3125)
[14] bin/godot.linuxbsd.editor.x86_64() [0x275f764] (/home/hugo/Documents/Git/godotengine/godot/platform/linuxbsd/os_linuxbsd.cpp:878)
[15] bin/godot.linuxbsd.editor.x86_64() [0x2752590] (/home/hugo/Documents/Git/godotengine/godot/platform/linuxbsd/godot_linuxbsd.cpp:75)
[16] /lib64/libc.so.6(+0x27510) [0x7fe67c56a510] (??:0)
[17] /lib64/libc.so.6(__libc_start_main+0x89) [0x7fe67c56a5c9] (??:0)
[18] bin/godot.linuxbsd.editor.x86_64() [0x2752375] (??:?)
-- END OF BACKTRACE --
================================================================
[1]    41752 IOT instruction (core dumped)  bin/godot.linuxbsd.editor.x86_64 /tmp/4/project.godot

Testing projects:

• 3.x: test_audio_import_crash_3.x.zip
• 4.x: test_audio_import_crash_4.x.zip

[akien-mga]

Still reproducible in current master (9ab388c):

================================================================
handle_crash: Program crashed with signal 11
Engine version: Godot Engine v4.1.beta.custom_build (9ab388c146895cfacf87d09d28c148e186f348b6)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[1] /lib64/libc.so.6(+0x36980) [0x7efd46d72980] (??:0)
[2] Error CowData<float>::resize<false>(int) (/home/akien/Projects/godot/godot.git/./core/templates/cowdata.h:314)
[3] Vector<float>::resize(int) (/home/akien/Projects/godot/godot.git/./core/templates/vector.h:94)
[4] ResourceImporterWAV::import(String const&, String const&, HashMap<StringName, Variant, HashMapHasherDefault, HashMapComparatorDefault<StringName>, DefaultTypedAllocator<HashMapElement<StringName, Variant> > > const&, List<String, DefaultAllocator>*, List<String, DefaultAllocator>*, Variant*) (/home/akien/Projects/godot/godot.git/./editor/import/resource_importer_wav.cpp:215)
[5] EditorFileSystem::_reimport_file(String const&, HashMap<StringName, Variant, HashMapHasherDefault, HashMapComparatorDefault<StringName>, DefaultTypedAllocator<HashMapElement<StringName, Variant> > > const&, String const&, Variant*) (/home/akien/Projects/godot/godot.git/./editor/editor_file_system.cpp:2041)
[6] EditorFileSystem::reimport_files(Vector<String> const&) (/home/akien/Projects/godot/godot.git/./editor/editor_file_system.cpp:2276 (discriminator 6))
[7] EditorFileSystem::_update_scan_actions() (/home/akien/Projects/godot/godot.git/./editor/editor_file_system.cpp:689)
[8] EditorFileSystem::_notification(int) (/home/akien/Projects/godot/godot.git/./editor/editor_file_system.cpp:1282)
[9] EditorFileSystem::_notificationv(int, bool) (/home/akien/Projects/godot/godot.git/./editor/editor_file_system.h:146 (discriminator 14))
[10] Object::notification(int, bool) (/home/akien/Projects/godot/godot.git/./core/object/object.cpp:798)
[11] SceneTree::_process_group(SceneTree::ProcessGroup*, bool) (/home/akien/Projects/godot/godot.git/./scene/main/scene_tree.cpp:945)
[12] SceneTree::_process(bool) (/home/akien/Projects/godot/godot.git/./scene/main/scene_tree.cpp:1018 (discriminator 2))
[13] SceneTree::process(double) (/home/akien/Projects/godot/godot.git/./scene/main/scene_tree.cpp:510)
[14] Main::iteration() (/home/akien/Projects/godot/godot.git/main/main.cpp:3421)
[15] OS_LinuxBSD::run() (/home/akien/Projects/godot/godot.git/platform/linuxbsd/os_linuxbsd.cpp:912)
[16] godot-git(main+0x15a) [0x56770c0] (/home/akien/Projects/godot/godot.git/platform/linuxbsd/godot_linuxbsd.cpp:76)
[17] /lib64/libc.so.6(+0x236b7) [0x7efd46d5f6b7] (??:0)
[18] /lib64/libc.so.6(__libc_start_main+0x85) [0x7efd46d5f775] (??:0)
[19] godot-git(_start+0x21) [0x5676ea1] (??:?)
-- END OF BACKTRACE --
================================================================
Aborted (core dumped)