Bug#1054661: blastem: Segfault when trying to open rom or access system settings

[Bernhard Übelacker]

On Sat, 28 Oct 2023 12:52:30 +0200 Tobias Frost <tobi at debian.org> wrote:
> Control: tags -1 confirmed
> 
> Here's a backtrace when clicking on Settings -> System. 
> Thread 1 "blastem" received signal SIGSEGV, Segmentation fault.
> tern_foreach_int (head=<optimized out>, fun=0x5555555c12a0 <model_iter>, data=0x7fffffffd7f0, keybuf=0x7fffffffd8c0 "\020", pos=0)
>     at /build/blastem-kipVNx/blastem-0.6.3.4/tern.c:268
> 268		if (!head->el) {
> (gdb) bt
> #0  tern_foreach_int (head=<optimized out>, fun=0x5555555c12a0 <model_iter>, data=0x7fffffffd7f0, keybuf=0x7fffffffd8c0 "\020", pos=0) at /build/blastem-kipVNx/blastem-0.6.3.4/tern.c:268
> #1  0x00005555555c7e15 in tern_foreach (data=0x7fffffffd7f0, fun=0x5555555c12a0 <model_iter>, head=<optimized out>) at /build/blastem-kipVNx/blastem-0.6.3.4/tern.c:291
> #2  get_models (num_out=0x5555557a8ba0 <num_models>) at nuklear_ui/blastem_nuklear.c:1873
> #3  view_system_settings (context=0x555555611ab8 <sdl.lto_priv+216>) at nuklear_ui/blastem_nuklear.c:1907
> #4  0x00005555555c8354 in blastem_nuklear_render () at nuklear_ui/blastem_nuklear.c:2049
> #5  0x0000555555589e1b in render_update_display () at /build/blastem-kipVNx/blastem-0.6.3.4/render_sdl.c:1783
> #6  0x00005555555caeeb in ui_idle_loop () at nuklear_ui/blastem_nuklear.c:2075
> #7  0x000055555555defa in blastem_nuklear_init (file_loaded=0 '\000') at nuklear_ui/blastem_nuklear.c:2332
> #8  main (argc=<optimized out>, argv=<optimized out>) at /build/blastem-kipVNx/blastem-0.6.3.4/blastem.c:714
> (gdb) 
> 
> Did not investigate further.
> 

Hello,
tried to take a little deeper look.
And it seems it is just a missing packaged config file:


(rr)
0x000055c0356f0361      1012                    return NULL;
1: x/i $pc
=> 0x55c0356f0361 <read_bundled_file+241>:      xor    %r13d,%r13d
10: /x $r13 = 0x0
(rr) bt
#0  0x000055c0356f0361 in read_bundled_file (name=name at entry=0x55c03574ae4a "systems.cfg", sizeret=sizeret at entry=0x7ffc07889c88) at /build/blastem-kipVNx/blastem-0.6.3.4/util.c:1012
#1  0x000055c0356f0a2d in parse_bundled_config (config_name=0x55c03574ae4a "systems.cfg") at /build/blastem-kipVNx/blastem-0.6.3.4/config.c:217
#2  0x000055c03571ff56 in get_systems_config () at /build/blastem-kipVNx/blastem-0.6.3.4/config.c:331
#3  get_models (num_out=0x55c035900ba0 <num_models>) at nuklear_ui/blastem_nuklear.c:1866
#4  view_system_settings (context=0x55c035769ab8 <sdl.lto_priv+216>) at nuklear_ui/blastem_nuklear.c:1907
#5  0x000055c035720354 in blastem_nuklear_render () at nuklear_ui/blastem_nuklear.c:2049
#6  0x000055c0356e1e1b in render_update_display () at /build/blastem-kipVNx/blastem-0.6.3.4/render_sdl.c:1783
#7  0x000055c035722eeb in ui_idle_loop () at nuklear_ui/blastem_nuklear.c:2075
#8  0x000055c0356b5efa in blastem_nuklear_init (file_loaded=0 '\000') at nuklear_ui/blastem_nuklear.c:2332
#9  main (argc=<optimized out>, argv=<optimized out>) at /build/blastem-kipVNx/blastem-0.6.3.4/blastem.c:714


Function `read_bundled_file` does not find "systems.cfg",
therefore returns NULL,
therefore `parse_bundled_config` returns also NULL,
which is then also returned by `get_systems_config`.

This NULL is given unconditionally into tern_foreach in blasem_nuklear.c line 1873,
and gets dereferenced.


Following change would add systems.cfg to the Debian package,
and did avoid the crash in a short test.

Kind regards,
Bernhard


diff -Nurp orig/blastem-0.6.3.4/debian/blastem.install try2/blastem-0.6.3.4/debian/blastem.install
--- orig/blastem-0.6.3.4/debian/blastem.install 2021-09-24 22:14:33.000000000 +0200
+++ try2/blastem-0.6.3.4/debian/blastem.install 2024-05-06 14:31:55.277695226 +0200
@@ -6,3 +6,4 @@ gamecontrollerdb.txt            usr/share/games/bl
  images                         usr/share/games/blastem
  rom.db                         usr/share/games/blastem
  shaders                                usr/share/games/blastem
+systems.cfg                    usr/share/games/blastem