Skip to content

Instantly share code, notes, and snippets.

@city41
Created September 30, 2020 18:03
Show Gist options
  • Save city41/ab6d14b3ffd3494e6e4f01e8b3dc5f66 to your computer and use it in GitHub Desktop.
Save city41/ab6d14b3ffd3494e6e4f01e8b3dc5f66 to your computer and use it in GitHub Desktop.
-- START test_get_search_highlights_during_visual --
=================================================================
==297823==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b0000003b7 at pc 0x7fa720372917 bp 0x7ffd27057950 sp 0x7ffd270570f8
READ of size 1 at 0x60b0000003b7 thread T0
#0 0x7fa720372916 (/lib/x86_64-linux-gnu/libasan.so.5+0xd7916)
#1 0x55d3560c56f1 in vim_regcomp (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x986f1)
#2 0x55d3560d797f in search_regcomp (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0xaa97f)
#3 0x55d3560d8665 in searchit (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0xab665)
#4 0x55d356059917 in vimSearchGetHighlights (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x2c917)
#5 0x55d356057293 in test_get_search_highlights_during_visual apitest/cmdline_search.c:28
#6 0x55d356058742 in test_suite apitest/cmdline_search.c:119
#7 0x55d356058cbb in main apitest/cmdline_search.c:134
#8 0x7fa71f5b10b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#9 0x55d3560569ad in _start (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x299ad)
0x60b0000003b7 is located 7 bytes inside of 100-byte region [0x60b0000003b0,0x60b000000414)
freed by thread T0 here:
#0 0x7fa7203a87cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
#1 0x55d35606c608 in vim_free (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x3f608)
#2 0x55d3561b99f3 in abandon_cmdline (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x18c9f3)
#3 0x55d3561bfef3 in state_cmdline_execute (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x192ef3)
#4 0x55d3560e7094 in sm_execute (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0xba094)
#5 0x55d3560e6fd0 in sm_execute_normal (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0xb9fd0)
#6 0x55d356059583 in vimInputCore (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x2c583)
#7 0x55d3560596c8 in vimKey (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x2c6c8)
#8 0x55d356057279 in test_get_search_highlights_during_visual apitest/cmdline_search.c:26
#9 0x55d356058742 in test_suite apitest/cmdline_search.c:119
#10 0x55d356058cbb in main apitest/cmdline_search.c:134
#11 0x7fa71f5b10b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
previously allocated by thread T0 here:
#0 0x7fa7203a8bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55d35606b764 in lalloc (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x3e764)
#2 0x55d35606b5f2 in alloc (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x3e5f2)
#3 0x55d3561c0935 in alloc_cmdbuff (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x193935)
#4 0x55d3561be251 in state_cmdline_initialize (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x191251)
#5 0x55d3560e6f23 in sm_push_cmdline (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0xb9f23)
#6 0x55d3561f95c9 in nv_colon (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x1cc5c9)
#7 0x55d3561f2a00 in state_normal_cmd_execute (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x1c5a00)
#8 0x55d3560e7094 in sm_execute (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0xba094)
#9 0x55d3560e6fd0 in sm_execute_normal (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0xb9fd0)
#10 0x55d35605959d in vimInputCore (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x2c59d)
#11 0x55d3560596a4 in vimInput (/home/matt/dev/libvim/src/_esy/test/store/b/libvim-db9de2ae/apitest/cmdline_search.test.exe+0x2c6a4)
#12 0x55d35605726d in test_get_search_highlights_during_visual apitest/cmdline_search.c:25
#13 0x55d356058742 in test_suite apitest/cmdline_search.c:119
#14 0x55d356058cbb in main apitest/cmdline_search.c:134
#15 0x7fa71f5b10b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0xd7916)
Shadow bytes around the buggy address:
0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c167fff8040: 00 fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
0x0c167fff8050: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
0x0c167fff8060: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
=>0x0c167fff8070: fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd
0x0c167fff8080: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==297823==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment