Skip to content

Instantly share code, notes, and snippets.

@dogbert17
Created March 29, 2018 16:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dogbert17/dfcb5716be03f68cfe2acf4348b27e9c to your computer and use it in GitHub Desktop.
Save dogbert17/dfcb5716be03f68cfe2acf4348b27e9c to your computer and use it in GitHub Desktop.
Cro+SHA256
=================================================================
==21486==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b0000e9778 at pc 0x7ffff6ef6904 bp 0x7fffe7b40a60 sp 0x7fffe7b40208
WRITE of size 96 at 0x60b0000e9778 thread T4
#0 0x7ffff6ef6903 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c903)
#1 0x7ffff5d8ff0f in create_context_only src/core/frame.c:187
#2 0x7ffff5d901ec in autoclose src/core/frame.c:215
#3 0x7ffff5d90421 in autoclose src/core/frame.c:228
#4 0x7ffff5d921f3 in MVM_frame_invoke src/core/frame.c:457
#5 0x7ffff5e96d33 in invoke_handler src/6model/reprs/MVMCode.c:10
#6 0x7ffff5d0b776 in MVM_interp_run src/core/interp.c:993
#7 0x7ffff5dadde2 in start_thread src/core/threads.c:87
#8 0x7ffff50976b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
#9 0x7ffff53b441c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
0x60b0000e9778 is located 8 bytes inside of 104-byte region [0x60b0000e9770,0x60b0000e97d8)
freed by thread T4 here:
#0 0x7ffff6f022ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
#1 0x7ffff5de3cf8 in MVM_free src/core/alloc.h:40
#2 0x7ffff5de5072 in MVM_fixed_size_free src/core/fixedsizealloc.c:300
#3 0x7ffff5d8f73f in MVM_frame_destroy src/core/frame.c:131
#4 0x7ffff5e1fe47 in MVM_gc_collect_free_nursery_uncopied src/gc/collect.c:600
#5 0x7ffff5e0b4e7 in finish_gc src/gc/orchestrate.c:239
#6 0x7ffff5e0bf30 in run_gc src/gc/orchestrate.c:411
#7 0x7ffff5e0d2e3 in MVM_gc_enter_from_interrupt src/gc/orchestrate.c:611
#8 0x7ffff5e0b7a8 in MVM_gc_mark_thread_blocked src/gc/orchestrate.c:290
#9 0x7ffff5edee17 in MVM_reentrantmutex_lock src/6model/reprs/ReentrantMutex.c:136
#10 0x7ffff5f2a8da in MVM_serialization_demand_object src/6model/serialization.c:2743
#11 0x7ffff5f1272e in MVM_sc_get_object src/6model/sc.c:186
#12 0x7ffff5d8fd94 in create_context_only src/core/frame.c:177
#13 0x7ffff5d901ec in autoclose src/core/frame.c:215
#14 0x7ffff5d90421 in autoclose src/core/frame.c:228
#15 0x7ffff5d921f3 in MVM_frame_invoke src/core/frame.c:457
#16 0x7ffff5e96d33 in invoke_handler src/6model/reprs/MVMCode.c:10
#17 0x7ffff5d0b776 in MVM_interp_run src/core/interp.c:993
#18 0x7ffff5dadde2 in start_thread src/core/threads.c:87
#19 0x7ffff50976b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
previously allocated by thread T4 here:
#0 0x7ffff6f02602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x7ffff5de3c1f in MVM_malloc src/core/alloc.h:2
#2 0x7ffff5de4bf2 in MVM_fixed_size_alloc src/core/fixedsizealloc.c:178
#3 0x7ffff5d8fa88 in create_context_only src/core/frame.c:158
#4 0x7ffff5d901ec in autoclose src/core/frame.c:215
#5 0x7ffff5d90421 in autoclose src/core/frame.c:228
#6 0x7ffff5d921f3 in MVM_frame_invoke src/core/frame.c:457
#7 0x7ffff5e96d33 in invoke_handler src/6model/reprs/MVMCode.c:10
#8 0x7ffff5d0b776 in MVM_interp_run src/core/interp.c:993
#9 0x7ffff5dadde2 in start_thread src/core/threads.c:87
#10 0x7ffff50976b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
Thread T4 created by T3 here:
#0 0x7ffff6ea0253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
#1 0x7ffff60d2caf in uv_thread_create (//home/dilbert/.rakudobrew/moar-master/nqp/MoarVM/../../install/lib/libmoar.so+0xa5bcaf)
Thread T3 created by T0 here:
#0 0x7ffff6ea0253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
#1 0x7ffff60d2caf in uv_thread_create (//home/dilbert/.rakudobrew/moar-master/nqp/MoarVM/../../install/lib/libmoar.so+0xa5bcaf)
SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __asan_memcpy
Shadow bytes around the buggy address:
0x0c1680015290: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
0x0c16800152a0: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd
0x0c16800152b0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x0c16800152c0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c16800152d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c16800152e0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd[fd]
0x0c16800152f0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c1680015300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1680015310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1680015320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1680015330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==21486==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment