Out of bounds write in lib\src\types\world\mod.rs #8

Closed
opened 2025-08-31 21:09:48 +02:00 by Opoodoop · 4 comments

when first starting the server block place colision detection seems not to work
repeatedly placing blocks inside the player eventually leads to a out of bounds write which leads to a panic
after the panic the block placement seems to work as expected as well as doors and fence gates now start working

heres the code that has the issue
the issue is on line 182 in lib\src\types\world\mod.rs

178 pub fn set_block(&mut self, position_in_chunk: Position, block_state_id: u16) {
179     self.modified = true;
180     let section_id = (position_in_chunk.y + 64) / 16;
181     let block_id = position_in_chunk.x + (position_in_chunk.z * 16) + (((position_in_chunk.y as i32 + 64) - (section_id as i32 * 16)) * 256);
182     self.sections[section_id as usize].blocks[block_id as usize] = block_state_id;
183   }

here is the full stacktrace that clearly shows block_id being used to index into blocks but the length of blocks is 0

thread '<unnamed>' panicked at /oxide/lib/src/types/world/mod.rs:182:46:
index out of bounds: the len is 0 but the index is 16
stack backtrace:
   0:     0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::win64::trace
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\win64.rs:85
   1:     0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::trace_unsynchronized
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\mod.rs:66
   2:     0x7ff7fe41a2e2 - std::sys::backtrace::_print_fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:66
   3:     0x7ff7fe41a2e2 - std::sys::backtrace::impl$0::print::impl$0::fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:39
   4:     0x7ff7fe43028b - core::fmt::rt::Argument::fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\rt.rs:173
   5:     0x7ff7fe43028b - core::fmt::write
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\mod.rs:1465
   6:     0x7ff7fe415ee7 - std::io::default_write_fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:639
   7:     0x7ff7fe415ee7 - std::io::Write::write_fmt<std::sys::stdio::windows::Stderr>
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:1954
   8:     0x7ff7fe41a125 - std::sys::backtrace::BacktraceLock::print
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:42
   9:     0x7ff7fe41c12f - std::panicking::default_hook::closure$0
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:300
  10:     0x7ff7fe41bec5 - std::panicking::default_hook
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:327
  11:     0x7ff7fe41cbed - std::panicking::rust_panic_with_hook
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:833
  12:     0x7ff7fe41ca79 - std::panicking::begin_panic_handler::closure$0
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:706
  13:     0x7ff7fe41a9cf - std::sys::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:168
  14:     0x7ff7fe41c68e - std::panicking::begin_panic_handler
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:697
  15:     0x7ff7fe441f61 - core::panicking::panic_fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\panicking.rs:75
  16:     0x7ff7fe4420c9 - core::panicking::panic_bounds_check
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\panicking.rs:280
  17:     0x7ff7fdb31021 - lib::types::world::Dimension::overwrite_block::h9dd1db8a185fcdfd
  18:     0x7ff7fdad390a - oxide::packet_handlers::play::use_item_on::he68ec8d3559ce85b
  19:     0x7ff7fdaf45d6 - oxide::packet_handlers::handle_packet::h7846549677e207ed
  20:     0x7ff7fdae1109 - std::sys::backtrace::__rust_begin_short_backtrace::h458a0d3a8a4edca9
  21:     0x7ff7fdae9d04 - <&T as core::fmt::Debug>::fmt::h98e32b2379397d98
  22:     0x7ff7fe41e18d - alloc::boxed::impl$28::call_once
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966
  23:     0x7ff7fe41e18d - alloc::boxed::impl$28::call_once
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966
  24:     0x7ff7fe41e18d - std::sys::pal::windows::thread::impl$0::new::thread_start
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\pal\windows\thread.rs:60
  25:     0x7fff9a84259d - BaseThreadInitThunk
  26:     0x7fff9af2af58 - RtlUserThreadStart

thread '<unnamed>' panicked at src\main.rs:142:46:
called `Result::unwrap()` on an `Err` value: PoisonError { .. }
stack backtrace:
   0:     0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::win64::trace
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\win64.rs:85
   1:     0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::trace_unsynchronized
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\mod.rs:66
   2:     0x7ff7fe41a2e2 - std::sys::backtrace::_print_fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:66
   3:     0x7ff7fe41a2e2 - std::sys::backtrace::impl$0::print::impl$0::fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:39
   4:     0x7ff7fe43028b - core::fmt::rt::Argument::fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\rt.rs:173
   5:     0x7ff7fe43028b - core::fmt::write
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\mod.rs:1465
   6:     0x7ff7fe415ee7 - std::io::default_write_fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:639
   7:     0x7ff7fe415ee7 - std::io::Write::write_fmt<std::sys::stdio::windows::Stderr>
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:1954
   8:     0x7ff7fe41a125 - std::sys::backtrace::BacktraceLock::print
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:42
   9:     0x7ff7fe41c12f - std::panicking::default_hook::closure$0
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:300
  10:     0x7ff7fe41bec5 - std::panicking::default_hook
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:327
  11:     0x7ff7fe41cbed - std::panicking::rust_panic_with_hook
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:833
  12:     0x7ff7fe41ca79 - std::panicking::begin_panic_handler::closure$0
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:706
  13:     0x7ff7fe41a9cf - std::sys::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:168
  14:     0x7ff7fe41c68e - std::panicking::begin_panic_handler
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:697
  15:     0x7ff7fe441f61 - core::panicking::panic_fmt
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\panicking.rs:75
  16:     0x7ff7fe442330 - core::result::unwrap_failed
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\result.rs:1761
  17:     0x7ff7fdaf2af1 - oxide::main_loop::h9f74ef3a1eb023b6
  18:     0x7ff7fdae0ef9 - std::sys::backtrace::__rust_begin_short_backtrace::h2c16eb20908a3a43
  19:     0x7ff7fdae9165 - <&T as core::fmt::Debug>::fmt::h98e32b2379397d98
  20:     0x7ff7fe41e18d - alloc::boxed::impl$28::call_once
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966
  21:     0x7ff7fe41e18d - alloc::boxed::impl$28::call_once
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966
  22:     0x7ff7fe41e18d - std::sys::pal::windows::thread::impl$0::new::thread_start
                               at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\pal\windows\thread.rs:60
  23:     0x7fff9a84259d - BaseThreadInitThunk
  24:     0x7fff9af2af58 - RtlUserThreadStart
when first starting the server block place colision detection seems not to work repeatedly placing blocks inside the player eventually leads to a out of bounds write which leads to a panic after the panic the block placement seems to work as expected as well as doors and fence gates now start working heres the code that has the issue the issue is on line 182 in lib\src\types\world\mod.rs ```rs 178 pub fn set_block(&mut self, position_in_chunk: Position, block_state_id: u16) { 179 self.modified = true; 180 let section_id = (position_in_chunk.y + 64) / 16; 181 let block_id = position_in_chunk.x + (position_in_chunk.z * 16) + (((position_in_chunk.y as i32 + 64) - (section_id as i32 * 16)) * 256); 182 self.sections[section_id as usize].blocks[block_id as usize] = block_state_id; 183 } ``` here is the full stacktrace that clearly shows block_id being used to index into blocks but the length of blocks is 0 ``` thread '<unnamed>' panicked at /oxide/lib/src/types/world/mod.rs:182:46: index out of bounds: the len is 0 but the index is 16 stack backtrace: 0: 0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::win64::trace at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\win64.rs:85 1: 0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::trace_unsynchronized at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\mod.rs:66 2: 0x7ff7fe41a2e2 - std::sys::backtrace::_print_fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:66 3: 0x7ff7fe41a2e2 - std::sys::backtrace::impl$0::print::impl$0::fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:39 4: 0x7ff7fe43028b - core::fmt::rt::Argument::fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\rt.rs:173 5: 0x7ff7fe43028b - core::fmt::write at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\mod.rs:1465 6: 0x7ff7fe415ee7 - std::io::default_write_fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:639 7: 0x7ff7fe415ee7 - std::io::Write::write_fmt<std::sys::stdio::windows::Stderr> at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:1954 8: 0x7ff7fe41a125 - std::sys::backtrace::BacktraceLock::print at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:42 9: 0x7ff7fe41c12f - std::panicking::default_hook::closure$0 at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:300 10: 0x7ff7fe41bec5 - std::panicking::default_hook at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:327 11: 0x7ff7fe41cbed - std::panicking::rust_panic_with_hook at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:833 12: 0x7ff7fe41ca79 - std::panicking::begin_panic_handler::closure$0 at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:706 13: 0x7ff7fe41a9cf - std::sys::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$> at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:168 14: 0x7ff7fe41c68e - std::panicking::begin_panic_handler at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:697 15: 0x7ff7fe441f61 - core::panicking::panic_fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\panicking.rs:75 16: 0x7ff7fe4420c9 - core::panicking::panic_bounds_check at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\panicking.rs:280 17: 0x7ff7fdb31021 - lib::types::world::Dimension::overwrite_block::h9dd1db8a185fcdfd 18: 0x7ff7fdad390a - oxide::packet_handlers::play::use_item_on::he68ec8d3559ce85b 19: 0x7ff7fdaf45d6 - oxide::packet_handlers::handle_packet::h7846549677e207ed 20: 0x7ff7fdae1109 - std::sys::backtrace::__rust_begin_short_backtrace::h458a0d3a8a4edca9 21: 0x7ff7fdae9d04 - <&T as core::fmt::Debug>::fmt::h98e32b2379397d98 22: 0x7ff7fe41e18d - alloc::boxed::impl$28::call_once at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966 23: 0x7ff7fe41e18d - alloc::boxed::impl$28::call_once at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966 24: 0x7ff7fe41e18d - std::sys::pal::windows::thread::impl$0::new::thread_start at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\pal\windows\thread.rs:60 25: 0x7fff9a84259d - BaseThreadInitThunk 26: 0x7fff9af2af58 - RtlUserThreadStart thread '<unnamed>' panicked at src\main.rs:142:46: called `Result::unwrap()` on an `Err` value: PoisonError { .. } stack backtrace: 0: 0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::win64::trace at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\win64.rs:85 1: 0x7ff7fe41a2e2 - std::backtrace_rs::backtrace::trace_unsynchronized at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\..\..\backtrace\src\backtrace\mod.rs:66 2: 0x7ff7fe41a2e2 - std::sys::backtrace::_print_fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:66 3: 0x7ff7fe41a2e2 - std::sys::backtrace::impl$0::print::impl$0::fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:39 4: 0x7ff7fe43028b - core::fmt::rt::Argument::fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\rt.rs:173 5: 0x7ff7fe43028b - core::fmt::write at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\fmt\mod.rs:1465 6: 0x7ff7fe415ee7 - std::io::default_write_fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:639 7: 0x7ff7fe415ee7 - std::io::Write::write_fmt<std::sys::stdio::windows::Stderr> at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\io\mod.rs:1954 8: 0x7ff7fe41a125 - std::sys::backtrace::BacktraceLock::print at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:42 9: 0x7ff7fe41c12f - std::panicking::default_hook::closure$0 at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:300 10: 0x7ff7fe41bec5 - std::panicking::default_hook at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:327 11: 0x7ff7fe41cbed - std::panicking::rust_panic_with_hook at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:833 12: 0x7ff7fe41ca79 - std::panicking::begin_panic_handler::closure$0 at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:706 13: 0x7ff7fe41a9cf - std::sys::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$> at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\backtrace.rs:168 14: 0x7ff7fe41c68e - std::panicking::begin_panic_handler at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\panicking.rs:697 15: 0x7ff7fe441f61 - core::panicking::panic_fmt at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\panicking.rs:75 16: 0x7ff7fe442330 - core::result::unwrap_failed at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\core\src\result.rs:1761 17: 0x7ff7fdaf2af1 - oxide::main_loop::h9f74ef3a1eb023b6 18: 0x7ff7fdae0ef9 - std::sys::backtrace::__rust_begin_short_backtrace::h2c16eb20908a3a43 19: 0x7ff7fdae9165 - <&T as core::fmt::Debug>::fmt::h98e32b2379397d98 20: 0x7ff7fe41e18d - alloc::boxed::impl$28::call_once at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966 21: 0x7ff7fe41e18d - alloc::boxed::impl$28::call_once at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\alloc\src\boxed.rs:1966 22: 0x7ff7fe41e18d - std::sys::pal::windows::thread::impl$0::new::thread_start at /rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2/library\std\src\sys\pal\windows\thread.rs:60 23: 0x7fff9a84259d - BaseThreadInitThunk 24: 0x7fff9af2af58 - RtlUserThreadStart ```
Owner

thanks for reporting this! At the moment that is still expected behavior as there isn't any logic yet that checks what is at the location of the new block. You can also overwrite blocks that already exist in a location.
Once the server panics the logic that's internal to the client doesn't get overwritten anymore, as no conflicting data is coming from the server anymore, so certain things look like they're properly working suddenly.
I will definitely get to this in the nearish future :)

thanks for reporting this! At the moment that is still expected behavior as there isn't any logic yet that checks what is at the location of the new block. You can also overwrite blocks that already exist in a location. Once the server panics the logic that's internal to the client doesn't get overwritten anymore, as no conflicting data is coming from the server anymore, so certain things look like they're properly working suddenly. I will definitely get to this in the nearish future :)
thetxt added this to the 0.2.0 milestone 2025-08-31 21:36:14 +02:00
thetxt self-assigned this 2025-08-31 21:45:57 +02:00
Owner

actually Im not quite sure why this panic happens... It seems to be caused by trying to place a block in an empty chunk section

actually Im not quite sure why this panic happens... It seems to be caused by trying to place a block in an empty chunk section
Author

Upon closer inspection does it seem like all might not be good after the panic.
blocks placed and broken by other players just stop getting shared as well as commands no longer working
I'll keep looking into it

Upon closer inspection does it seem like all might not be good after the panic. blocks placed and broken by other players just stop getting shared as well as commands no longer working I'll keep looking into it
Owner

I think I fixed this in the branch 0.2.0

The panic was caused by an memory optimizations that didn't store block data for empty chunk sections. Fixed this by adding a check if the chunk section is empty and then initializing it with air blocks first, before writing to it

I think I fixed this in the branch 0.2.0 The panic was caused by an memory optimizations that didn't store block data for empty chunk sections. Fixed this by adding a check if the chunk section is empty and then initializing it with air blocks first, before writing to it
Sign in to join this conversation.
No description provided.