Double free r2

bt.txt

% r2 gdb://127.0.0.1:1236 -e dbg.exe.path=some/bad/path
*** Error in `r2': double free or corruption (fasttop): 0x00005640cdb401e0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7ff82eb69bcb]
/lib/x86_64-linux-gnu/libc.so.6(+0x76f96)[0x7ff82eb6ff96]
/lib/x86_64-linux-gnu/libc.so.6(+0x777de)[0x7ff82eb707de]
/usr/local/lib/libr_util.so(r_list_delete+0x5e)[0x7ff82f306c1b]
/usr/local/lib/libr_util.so(r_list_purge+0x3f)[0x7ff82f306aeb]
/usr/local/lib/libr_util.so(r_list_free+0x1f)[0x7ff82f306b37]
/usr/local/lib/libr_io.so(+0x4a1ce)[0x7ff8315c71ce]
/usr/local/lib/libr_io.so(gdbr_read_target_xml+0x65)[0x7ff8315c6657]
/usr/local/lib/libr_io.so(gdbr_connect+0x3b3)[0x7ff8315c1c6b]
/usr/local/lib/libr_io.so(+0x14a76)[0x7ff831591a76]
/usr/local/lib/libr_io.so(r_io_desc_open+0x93)[0x7ff8315a5b40]
/usr/local/lib/libr_io.so(r_io_open_nomap+0x3a)[0x7ff8315a07b7]
/usr/local/lib/libr_core.so(r_core_file_open+0xc1)[0x7ff833501f62]
r2(+0x5b2e)[0x5640cbf1ab2e]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7ff82eb192b1]
r2(+0x2ffa)[0x5640cbf17ffa]
======= Memory map: ========
5640cbf15000-5640cbf1e000 r-xp 00000000 fe:01 534116                     /usr/local/bin/radare2
5640cc11d000-5640cc11e000 r--p 00008000 fe:01 534116                     /usr/local/bin/radare2
5640cc11e000-5640cc11f000 rw-p 00009000 fe:01 534116                     /usr/local/bin/radare2
5640cc11f000-5640cc180000 rw-p 00000000 00:00 0
5640cda05000-5640cdb51000 rw-p 00000000 00:00 0                          [heap]
7ff828000000-7ff828021000 rw-p 00000000 00:00 0
7ff828021000-7ff82c000000 ---p 00000000 00:00 0
7ff82e3da000-7ff82e3f0000 r-xp 00000000 fe:01 540666                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff82e3f0000-7ff82e5ef000 ---p 00016000 fe:01 540666                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff82e5ef000-7ff82e5f0000 r--p 00015000 fe:01 540666                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff82e5f0000-7ff82e5f1000 rw-p 00016000 fe:01 540666                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff82e5f1000-7ff82e5f3000 r-xp 00000000 fe:01 1052605                    /usr/local/lib/radare2/2.1.0/asm_propeller.so
7ff82e5f3000-7ff82e7f3000 ---p 00002000 fe:01 1052605                    /usr/local/lib/radare2/2.1.0/asm_propeller.so
7ff82e7f3000-7ff82e7f4000 r--p 00002000 fe:01 1052605                    /usr/local/lib/radare2/2.1.0/asm_propeller.so
7ff82e7f4000-7ff82e7f5000 rw-p 00003000 fe:01 1052605                    /usr/local/lib/radare2/2.1.0/asm_propeller.so
7ff82e7f5000-7ff82e8f8000 r-xp 00000000 fe:01 546597                     /lib/x86_64-linux-gnu/libm-2.24.so
7ff82e8f8000-7ff82eaf7000 ---p 00103000 fe:01 546597                     /lib/x86_64-linux-gnu/libm-2.24.so
7ff82eaf7000-7ff82eaf8000 r--p 00102000 fe:01 546597                     /lib/x86_64-linux-gnu/libm-2.24.so
7ff82eaf8000-7ff82eaf9000 rw-p 00103000 fe:01 546597                     /lib/x86_64-linux-gnu/libm-2.24.so
7ff82eaf9000-7ff82ec8e000 r-xp 00000000 fe:01 546593                     /lib/x86_64-linux-gnu/libc-2.24.so
7ff82ec8e000-7ff82ee8e000 ---p 00195000 fe:01 546593                     /lib/x86_64-linux-gnu/libc-2.24.so
7ff82ee8e000-7ff82ee92000 r--p 00195000 fe:01 546593                     /lib/x86_64-linux-gnu/libc-2.24.so
7ff82ee92000-7ff82ee94000 rw-p 00199000 fe:01 546593                     /lib/x86_64-linux-gnu/libc-2.24.so
7ff82ee94000-7ff82ee98000 rw-p 00000000 00:00 0
7ff82ee98000-7ff82ee9a000 r-xp 00000000 fe:01 546612                     /lib/x86_64-linux-gnu/libutil-2.24.so
7ff82ee9a000-7ff82f099000 ---p 00002000 fe:01 546612                     /lib/x86_64-linux-gnu/libutil-2.24.so
7ff82f099000-7ff82f09a000 r--p 00001000 fe:01 546612                     /lib/x86_64-linux-gnu/libutil-2.24.so
7ff82f09a000-7ff82f09b000 rw-p 00002000 fe:01 546612                     /lib/x86_64-linux-gnu/libutil-2.24.so
7ff82f09b000-7ff82f0b3000 r-xp 00000000 fe:01 546608                     /lib/x86_64-linux-gnu/libpthread-2.24.so
7ff82f0b3000-7ff82f2b2000 ---p 00018000 fe:01 546608                     /lib/x86_64-linux-gnu/libpthread-2.24.so
7ff82f2b2000-7ff82f2b3000 r--p 00017000 fe:01 546608                     /lib/x86_64-linux-gnu/libpthread-2.24.so
7ff82f2b3000-7ff82f2b4000 rw-p 00018000 fe:01 546608                     /lib/x86_64-linux-gnu/libpthread-2.24.so
7ff82f2b4000-7ff82f2b8000 rw-p 00000000 00:00 0
7ff82f2b8000-7ff82f387000 r-xp 00000000 fe:01 534142                     /usr/local/lib/libr_util.so.2.1.0
7ff82f387000-7ff82f587000 ---p 000cf000 fe:01 534142                     /usr/local/lib/libr_util.so.2.1.0
7ff82f587000-7ff82f589000 r--p 000cf000 fe:01 534142                     /usr/local/lib/libr_util.so.2.1.0
7ff82f589000-7ff82f598000 rw-p 000d1000 fe:01 534142                     /usr/local/lib/libr_util.so.2.1.0
7ff82f598000-7ff82f5a2000 rw-p 00000000 00:00 0
7ff82f5a2000-7ff82f5b9000 r-xp 00000000 fe:01 534126                     /usr/local/lib/libr_crypto.so.2.1.0
7ff82f5b9000-7ff82f7b8000 ---p 00017000 fe:01 534126                     /usr/local/lib/libr_crypto.so.2.1.0
7ff82f7b8000-7ff82f7b9000 r--p 00016000 fe:01 534126                     /usr/local/lib/libr_crypto.so.2.1.0
7ff82f7b9000-7ff82f7ba000 rw-p 00017000 fe:01 534126                     /usr/local/lib/libr_crypto.so.2.1.0
7ff82f7ba000-7ff82f7cb000 rw-p 00000000 00:00 0
7ff82f7cb000-7ff82f7db000 r-xp 00000000 fe:01 534128                     /usr/local/lib/libr_egg.so.2.1.0
7ff82f7db000-7ff82f9da000 ---p 00010000 fe:01 534128                     /usr/local/lib/libr_egg.so.2.1.0
7ff82f9da000-7ff82f9db000 r--p 0000f000 fe:01 534128                     /usr/local/lib/libr_egg.so.2.1.0
7ff82f9db000-7ff82f9dc000 rw-p 00010000 fe:01 534128                     /usr/local/lib/libr_egg.so.2.1.0
7ff82f9dc000-7ff82f9e2000 r-xp 00000000 fe:01 534129                     /usr/local/lib/libr_flag.so.2.1.0
7ff82f9e2000-7ff82fbe2000 ---p 00006000 fe:01 534129                     /usr/local/lib/libr_flag.so.2.1.0
7ff82fbe2000-7ff82fbe3000 r--p 00006000 fe:01 534129                     /usr/local/lib/libr_flag.so.2.1.0
7ff82fbe3000-7ff82fbe4000 rw-p 00007000 fe:01 534129                     /usr/local/lib/libr_flag.so.2.1.0
7ff82fbe4000-7ff82fbf0000 r-xp 00000000 fe:01 534138                     /usr/local/lib/libr_socket.so.2.1.0
7ff82fbf0000-7ff82fdef000 ---p 0000c000 fe:01 534138                     /usr/local/lib/libr_socket.so.2.1.0
7ff82fdef000-7ff82fdf0000 r--p 0000b000 fe:01 534138                     /usr/local/lib/libr_socket.so.2.1.0
7ff82fdf0000-7ff82fdf1000 rw-p 0000c000 fe:01 534138                     /usr/local/lib/libr_socket.so.2.1.0
7ff82fdf1000-7ff82fe03000 r-xp 00000000 fe:01 534134                     /usr/local/lib/libr_magic.so.2.1.0
7ff82fe03000-7ff830002000 ---p 00012000 fe:01 534134                     /usr/local/lib/libr_magic.so.2.1.0
7ff830002000-7ff830003000 r--p 00011000 fe:01 534134                     /usr/local/lib/libr_magic.so.2.1.0
7ff830003000-7ff830004000 rw-p 00012000 fe:01 534134                     /usr/local/lib/libr_magic.so.2.1.0
7ff830004000-7ff83000e000 r-xp 00000000 fe:01 534131                     /usr/local/lib/libr_hash.so.2.1.0
7ff83000e000-7ff83020d000 ---p 0000a000 fe:01 534131                     /usr/local/lib/libr_hash.so.2.1.0
7ff83020d000-7ff83020e000 r--p 00009000 fe:01 534131                     /usr/local/lib/libr_hash.so.2.1.0
7ff83020e000-7ff83020f000 rw-p 0000a000 fe:01 534131                     /usr/local/lib/libr_hash.so.2.1.0
7ff83020f000-7ff830213000 r-xp 00000000 fe:01 534141                     /usr/local/lib/libr_syscall.so.2.1.0
7ff830213000-7ff830412000 ---p 00004000 fe:01 534141                     /usr/local/lib/libr_syscall.so.2.1.0
7ff830412000-7ff830413000 r--p 00003000 fe:01 534141                     /usr/local/lib/libr_syscall.so.2.1.0
7ff830413000-7ff830415000 rw-p 00004000 fe:01 534141                     /usr/local/lib/libr_syscall.so.2.1.0
7ff830415000-7ff8309b6000 r-xp 00000000 fe:01 534119                     /usr/local/lib/libr_asm.so.2.1.0
7ff8309b6000-7ff830bb6000 ---p 005a1000 fe:01 534119                     /usr/local/lib/libr_asm.so.2.1.0
7ff830bb6000-7ff830c4c000 r--p 005a1000 fe:01 534119                     /usr/local/lib/libr_asm.so.2.1.0
7ff830c4c000-7ff831018000 rw-p 00637000 fe:01 534119                     /usr/local/lib/libr_asm.so.2.1.0
7ff831018000-7ff831137000 rw-p 00000000 00:00 0
7ff831137000-7ff83113d000 r-xp 00000000 fe:01 534133                     /usr/local/lib/libr_lang.so.2.1.0
7ff83113d000-7ff83133c000 ---p 00006000 fe:01 534133                     /usr/local/lib/libr_lang.so.2.1.0
7ff83133c000-7ff83133d000 r--p 00005000 fe:01 534133                     /usr/local/lib/libr_lang.so.2.1.0
7ff83133d000-7ff83133e000 rw-p 00006000 fe:01 534133                     /usr/local/lib/libr_lang.so.2.1.0
7ff83133e000-7ff831370000 r-xp 00000000 fe:01 534130                     /usr/local/lib/libr_fs.so.2.1.0
7ff831370000-7ff83156f000 ---p 00032000 fe:01 534130                     /usr/local/lib/libr_fs.so.2.1.0
7ff83156f000-7ff831570000 r--p 00031000 fe:01 534130                     /usr/local/lib/libr_fs.so.2.1.0
7ff831570000-7ff831572000 rw-p 00032000 fe:01 534130                     /usr/local/lib/libr_fs.so.2.1.0
7ff831572000-7ff83157d000 rw-p 00000000 00:00 0
7ff83157d000-7ff8315de000 r-xp 00000000 fe:01 534132                     /usr/local/lib/libr_io.so.2.1.0
7ff8315de000-7ff8317dd000 ---p 00061000 fe:01 534132                     /usr/local/lib/libr_io.so.2.1.0
7ff8317dd000-7ff8317de000 r--p 00060000 fe:01 534132                     /usr/local/lib/libr_io.so.2.1.0
7ff8317de000-7ff8317ed000 rw-p 00061000 fe:01 534132                     /usr/local/lib/libr_io.so.2.1.0
7ff8317ed000-7ff8317f5000 rw-p 00000000 00:00 0
7ff8317f5000-7ff8317fa000 r-xp 00000000 fe:01 534121                     /usr/local/lib/libr_bp.so.2.1.0
7ff8317fa000-7ff8319f9000 ---p 00005000 fe:01 534121                     /usr/local/lib/libr_bp.so.2.1.0
7ff8319f9000-7ff8319fa000 r--p 00004000 fe:01 534121                     /usr/local/lib/libr_bp.so.2.1.0
7ff8319fa000-7ff8319fb000 rw-p 00005000 fe:01 534121                     /usr/local/lib/libr_bp.so.2.1.0
7ff8319fb000-7ff831a04000 r-xp 00000000 fe:01 534136                     /usr/local/lib/libr_reg.so.2.1.0
7ff831a04000-7ff831c04000 ---p 00009000 fe:01 534136                     /usr/local/lib/libr_reg.so.2.1.0
7ff831c04000-7ff831c05000 r--p 00009000 fe:01 534136                     /usr/local/lib/libr_reg.so.2.1.0
7ff831c05000-7ff831c06000 rw-p 0000a000 fe:01 534136                     /usr/local/lib/libr_reg.so.2.1.0
7ff831c06000-7ff832010000 r-xp 00000000 fe:01 534118                     /usr/local/lib/libr_anal.so.2.1.0
7ff832010000-7ff832210000 ---p 0040a000 fe:01 534118                     /usr/local/lib/libr_anal.so.2.1.0
7ff832210000-7ff832227000 r--p 0040a000 fe:01 534118                     /usr/local/lib/libr_anal.so.2.1.0
7ff832227000-7ff832512000 rw-p 00421000 fe:01 534118                     /usr/local/lib/libr_anal.so.2.1.0
7ff832512000-7ff832615000 rw-p 00000000 00:00 0
7ff832615000-7ff832644000 r-xp 00000000 fe:01 534127                     /usr/local/lib/libr_debug.so.2.1.0
7ff832644000-7ff832843000 ---p 0002f000 fe:01 534127                     /usr/local/lib/libr_debug.so.2.1.0
7ff832843000-7ff832844000 r--p 0002e000 fe:01 534127                     /usr/local/lib/libr_debug.so.2.1.0
7ff832844000-7ff832846000 rw-p 0002f000 fe:01 534127                     /usr/local/lib/libr_debug.so.2.1.0
7ff832846000-7ff832996000 r-xp 00000000 fe:01 534120                     /usr/local/lib/libr_bin.so.2.1.0
7ff832996000-7ff832b96000 ---p 00150000 fe:01 534120                     /usr/local/lib/libr_bin.so.2.1.0
7ff832b96000-7ff832b98000 r--p 00150000 fe:01 534120                     /usr/local/lib/libr_bin.so.2.1.0
7ff832b98000-7ff832ba1000 rw-p 00152000 fe:01 534120                     /usr/local/lib/libr_bin.so.2.1.0
7ff832ba1000-7ff832ba6000 r-xp 00000000 fe:01 534122                     /usr/local/lib/libr_config.so.2.1.0
7ff832ba6000-7ff832da5000 ---p 00005000 fe:01 534122                     /usr/local/lib/libr_config.so.2.1.0
7ff832da5000-7ff832da6000 r--p 00004000 fe:01 534122                     /usr/local/lib/libr_config.so.2.1.0
7ff832da6000-7ff832da7000 rw-p 00005000 fe:01 534122                     /usr/local/lib/libr_config.so.2.1.0
7ff832da7000-7ff832dc3000 r-xp 00000000 fe:01 534123                     /usr/local/lib/libr_cons.so.2.1.0
7ff832dc3000-7ff832fc2000 ---p 0001c000 fe:01 534123                     /usr/local/lib/libr_cons.so.2.1.0
7ff832fc2000-7ff832fc3000 r--p 0001b000 fe:01 534123                     /usr/local/lib/libr_cons.so.2.1.0
7ff832fc3000-7ff832fc4000 rw-p 0001c000 fe:01 534123                     /usr/local/lib/libr_cons.so.2.1.0
7ff832fc4000-7ff832fc7000 rw-p 00000000 00:00 0
7ff832fc7000-7ff832fcd000 r-xp 00000000 fe:01 534137                     /usr/local/lib/libr_search.so.2.1.0
7ff832fcd000-7ff8331cc000 ---p 00006000 fe:01 534137                     /usr/local/lib/libr_search.so.2.1.0
7ff8331cc000-7ff8331cd000 r--p 00005000 fe:01 534137                     /usr/local/lib/libr_search.so.2.1.0
7ff8331cd000-7ff8331ce000 rw-p 00006000 fe:01 534137                     /usr/local/lib/libr_search.so.2.1.0
7ff8331ce000-7ff833205000 r-xp 00000000 fe:01 534135                     /usr/local/lib/libr_parse.so.2.1.0
7ff833205000-7ff833404000 ---p 00037000 fe:01 534135                     /usr/local/lib/libr_parse.so.2.1.0
7ff833404000-7ff833405000 r--p 00036000 fe:01 534135                     /usr/local/lib/libr_parse.so.2.1.0
7ff833405000-7ff833406000 rw-p 00037000 fe:01 534135                     /usr/local/lib/libr_parse.so.2.1.0
7ff833406000-7ff833427000 rw-p 00000000 00:00 0
7ff833427000-7ff8335cd000 r-xp 00000000 fe:01 534124                     /usr/local/lib/libr_core.so.2.1.0
7ff8335cd000-7ff8337cc000 ---p 001a6000 fe:01 534124                     /usr/local/lib/libr_core.so.2.1.0
7ff8337cc000-7ff8337cd000 r--p 001a5000 fe:01 534124                     /usr/local/lib/libr_core.so.2.1.0
7ff8337cd000-7ff8337df000 rw-p 001a6000 fe:01 534124                     /usr/local/lib/libr_core.so.2.1.0
7ff8337df000-7ff8337e2000 rw-p 00000000 00:00 0
7ff8337e2000-7ff8337e5000 r-xp 00000000 fe:01 546596                     /lib/x86_64-linux-gnu/libdl-2.24.so
7ff8337e5000-7ff8339e4000 ---p 00003000 fe:01 546596                     /lib/x86_64-linux-gnu/libdl-2.24.so
7ff8339e4000-7ff8339e5000 r--p 00002000 fe:01 546596                     /lib/x86_64-linux-gnu/libdl-2.24.so
7ff8339e5000-7ff8339e6000 rw-p 00003000 fe:01 546596                     /lib/x86_64-linux-gnu/libdl-2.24.so
7ff8339e6000-7ff833a09000 r-xp 00000000 fe:01 546589                     /lib/x86_64-linux-gnu/ld-2.24.so
7ff833bac000-7ff833bc5000 r--s 00000000 fe:01 687663                     /usr/local/share/radare2/2.1.0/opcodes/x86.sdb
7ff833bc5000-7ff833bd1000 rw-p 00000000 00:00 0
7ff833be9000-7ff833bf0000 r--s 00000000 fe:01 687680                     /usr/local/share/radare2/2.1.0/syscall/linux-x86-64.sdb
7ff833bfb000-7ff833c02000 r--s 00000000 fe:01 687680                     /usr/local/share/radare2/2.1.0/syscall/linux-x86-64.sdb
7ff833c05000-7ff833c09000 rw-p 00000000 00:00 0
7ff833c09000-7ff833c0a000 r--p 00023000 fe:01 546589                     /lib/x86_64-linux-gnu/ld-2.24.so
7ff833c0a000-7ff833c0b000 rw-p 00024000 fe:01 546589                     /lib/x86_64-linux-gnu/ld-2.24.so
7ff833c0b000-7ff833c0c000 rw-p 00000000 00:00 0
7fffdeade000-7fffdeb00000 rw-p 00000000 00:00 0                          [stack]
7fffdeb80000-7fffdeb82000 r--p 00000000 00:00 0                          [vvar]
7fffdeb82000-7fffdeb84000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
[3]    27682 abort (core dumped)  r2 gdb://127.0.0.1:1236 -e dbg.exe.path=some/bad/path

valgrind.txt

% valgrind r2 gdb://127.0.0.1:1236 -e dbg.exe.path=some/bad/path
==13337== Memcheck, a memory error detector
==13337== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==13337== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info
==13337== Command: r2 gdb://127.0.0.1:1236 -e dbg.exe.path=some/bad/path
==13337==
==13337== Invalid free() / delete / delete[] / realloc()
==13337==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)
==13337==    by 0x92CAC1A: r_list_delete (list.c:93)
==13337==    by 0x92CAAEA: r_list_purge (list.c:62)
==13337==    by 0x92CAB36: r_list_free (list.c:72)
==13337==    by 0x70731CD: gdbr_parse_target_xml (xml.c:297)
==13337==    by 0x7072656: gdbr_read_target_xml (xml.c:23)
==13337==    by 0x706DC6A: gdbr_connect (core.c:189)
==13337==    by 0x703DA75: __open (io_gdb.c:116)
==13337==    by 0x7051B3F: r_io_desc_open (desc.c:105)
==13337==    by 0x704C7B6: r_io_open_nomap (io.c:258)
==13337==    by 0x5116F61: r_core_file_open (file.c:718)
==13337==    by 0x10DB2D: main (radare2.c:980)
==13337==  Address 0xa27ff80 is 0 bytes inside a block of size 48 free'd
==13337==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)
==13337==    by 0x92CAC1A: r_list_delete (list.c:93)
==13337==    by 0x92CAAEA: r_list_purge (list.c:62)
==13337==    by 0x92CAB36: r_list_free (list.c:72)
==13337==    by 0x70731CD: gdbr_parse_target_xml (xml.c:297)
==13337==    by 0x7072656: gdbr_read_target_xml (xml.c:23)
==13337==    by 0x706DC6A: gdbr_connect (core.c:189)
==13337==    by 0x703DA75: __open (io_gdb.c:116)
==13337==    by 0x7051B3F: r_io_desc_open (desc.c:105)
==13337==    by 0x704C7B6: r_io_open_nomap (io.c:258)
==13337==    by 0x5116F61: r_core_file_open (file.c:718)
==13337==    by 0x10DB2D: main (radare2.c:980)
==13337==  Block was alloc'd at
==13337==    at 0x4C2DBC5: calloc (vg_replace_malloc.c:711)
==13337==    by 0x7073E19: _extract_regs (xml.c:565)
==13337==    by 0x7072C84: gdbr_parse_target_xml (xml.c:166)
==13337==    by 0x7072656: gdbr_read_target_xml (xml.c:23)
==13337==    by 0x706DC6A: gdbr_connect (core.c:189)
==13337==    by 0x703DA75: __open (io_gdb.c:116)
==13337==    by 0x7051B3F: r_io_desc_open (desc.c:105)
==13337==    by 0x704C7B6: r_io_open_nomap (io.c:258)
==13337==    by 0x5116F61: r_core_file_open (file.c:718)
==13337==    by 0x10DB2D: main (radare2.c:980)
==13337==