Skip to content

Instantly share code, notes, and snippets.

@eiennohito
Created February 13, 2017 14:38
Show Gist options
  • Save eiennohito/fe9ac3672cb1c6b08e9c4a38c894af0f to your computer and use it in GitHub Desktop.
Save eiennohito/fe9ac3672cb1c6b08e9c4a38c894af0f to your computer and use it in GitHub Desktop.
=================================================================
==73792==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eeac at pc 0x00010eb336dd bp 0x7fff510d7030 sp 0x7fff510d7028
READ of size 4 at 0x60200000eeac thread T0
#0 0x10eb336dc in bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&)::$_0::operator()() const (test6+0x10000b6dc)
#1 0x10eb335fc in void std::__1::__invoke_void_return_wrapper<void>::__call<bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&)::$_0&>(bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&)::$_0&&&) (test6+0x10000b5fc)
#2 0x10eb33458 in std::__1::__function::__func<bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&)::$_0, std::__1::allocator<bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&)::$_0>, void ()>::operator()() (test6+0x10000b458)
#3 0x10eb2a7e2 in std::__1::function<void ()>::operator()() const (test6+0x1000027e2)
#4 0x10eb2a520 in main (test6+0x100002520)
#5 0x7fff9045d5ac in start (libdyld.dylib+0x35ac)
0x60200000eeac is located 4 bytes to the left of 12-byte region [0x60200000eeb0,0x60200000eebc)
freed by thread T0 here:
#0 0x10eb91bbb in wrap__ZdlPv (libclang_rt.asan_osx_dynamic.dylib+0x57bbb)
#1 0x10eb2ac57 in std::__1::__vector_base<int, std::__1::allocator<int> >::~__vector_base() (test6+0x100002c57)
#2 0x10eb2a824 in std::__1::vector<int, std::__1::allocator<int> >::~vector() (test6+0x100002824)
#3 0x10eb29bb4 in std::__1::vector<int, std::__1::allocator<int> >::~vector() (test6+0x100001bb4)
#4 0x10eb29869 in bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&) (test6+0x100001869)
#5 0x10eb2a02e in main (test6+0x10000202e)
#6 0x7fff9045d5ac in start (libdyld.dylib+0x35ac)
previously allocated by thread T0 here:
#0 0x10eb915fb in wrap__Znwm (libclang_rt.asan_osx_dynamic.dylib+0x575fb)
#1 0x10eb2b25c in std::__1::vector<int, std::__1::allocator<int> >::allocate(unsigned long) (test6+0x10000325c)
#2 0x10eb29356 in bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&) (test6+0x100001356)
#3 0x10eb2a02e in main (test6+0x10000202e)
#4 0x7fff9045d5ac in start (libdyld.dylib+0x35ac)
SUMMARY: AddressSanitizer: heap-buffer-overflow (test6+0x10000b6dc) in bugs(std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()> > >&)::$_0::operator()() const
Shadow bytes around the buggy address:
0x1c0400001d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400001d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400001da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400001db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400001dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x1c0400001dd0: fa fa fa fa fa[fa]fd fd fa fa 00 06 fa fa 00 00
0x1c0400001de0: fa fa 00 04 fa fa 00 06 fa fa 00 fa fa fa fd fd
0x1c0400001df0: fa fa fd fd fa fa 00 00 fa fa fd fd fa fa fd fa
0x1c0400001e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400001e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400001e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==73792==ABORTING
[1] 73792 abort ./test6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment