-
Notifications
You must be signed in to change notification settings - Fork 5.4k
Closed
Labels
area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMICLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMIbug
Milestone
Description
I've discovered a memory corruption bug which seems to affect Vector3s passed to functions. This minimal test case crashes consistently for me on Windows 10 (x64 running on a Ryden CPU) using .NET Core 2.1.301. The same test does not crash for me on MacOS with the same version of .NET Core.
using System.Numerics;
namespace NumericCorruption {
class Program {
static void Main(string[] args) {
var vec0 = new Vector3(0, 0, 0);
Test(vec0);
}
static void Test(Vector3 vec0) {
//vec0.X = -vec0.X; // Uncommenting this line will cause an access violation on the `new` line
vec0.X = 0; // Uncommenting this line will cause a null reference exception (?!) on the `new` line
new Vector3(vec0.X, vec0.Y, vec0.Z);
}
}
}As indicated, some degree of control is possible so this may have security implications in some regard. It also only appears to occur when the Vector3 is passed to another function; if you perform the same operations inside a given function, everything works as expected. Also, this only seems to occur when you assign one of the vector components; accessing components is fine, as is assigning whole vectors.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMICLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMIbug