Skip to content

Memory Corruption using System.Numerics.Vector3 #10972

@daeken

Description

@daeken

I've discovered a memory corruption bug which seems to affect Vector3s passed to functions. This minimal test case crashes consistently for me on Windows 10 (x64 running on a Ryden CPU) using .NET Core 2.1.301. The same test does not crash for me on MacOS with the same version of .NET Core.

using System.Numerics;
namespace NumericCorruption {
  class Program {
    static void Main(string[] args) {
      var vec0 = new Vector3(0, 0, 0);
      Test(vec0);
    }
    static void Test(Vector3 vec0) {
      //vec0.X = -vec0.X; // Uncommenting this line will cause an access violation on the `new` line
      vec0.X = 0; // Uncommenting this line will cause a null reference exception (?!) on the `new` line
      new Vector3(vec0.X, vec0.Y, vec0.Z);
    }
  }
}

As indicated, some degree of control is possible so this may have security implications in some regard. It also only appears to occur when the Vector3 is passed to another function; if you perform the same operations inside a given function, everything works as expected. Also, this only seems to occur when you assign one of the vector components; accessing components is fine, as is assigning whole vectors.

Metadata

Metadata

Assignees

Labels

area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMIbug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions