Skip to content

Instantly share code, notes, and snippets.

@thatsmydoing
Created July 13, 2023 10:36
Show Gist options
  • Save thatsmydoing/c8e82a531f3431cb8f066e4b54cb6dec to your computer and use it in GitHub Desktop.
Save thatsmydoing/c8e82a531f3431cb8f066e4b54cb6dec to your computer and use it in GitHub Desktop.
[3240739994650033] The DTLS handshake has been completed
[janus.plugin.videoroom-0x60400001a190] WebRTC media is now available
[8788938671007622] The DTLS handshake has been completed
[janus.plugin.videoroom-0x60400001a090] WebRTC media is now available
=================================================================
==472607==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000502f8 at pc 0x7f44877a46a6 bp 0x7f44876830f0 sp 0x7f44876830e8
READ of size 8 at 0x6020000502f8 thread T6
#0 0x7f44877a46a5 in janus_videoroom_handler plugins/janus_videoroom.c:10438
#1 0x7f448cb5864c in g_thread_proxy (/nix/store/fr53rm643lg0rp4qmgzzpwsz5xxdqwk0-glib-2.76.3/lib/libglib-2.0.so.0+0x8a64c)
#2 0x7f448c29fdd3 in start_thread (/nix/store/3n58xw4373jp0ljirf06d8077j15pc4j-glibc-2.37-8/lib/libc.so.6+0x85dd3)
#3 0x7f448c3219af in clone3 (/nix/store/3n58xw4373jp0ljirf06d8077j15pc4j-glibc-2.37-8/lib/libc.so.6+0x1079af)
0x6020000502f8 is located 8 bytes inside of 16-byte region [0x6020000502f0,0x602000050300)
freed by thread T6 here:
#0 0x7f448cebb0d8 in __interceptor_free.part.0 (/nix/store/v286z87irid5vn13y2z6fphfrzmgj0kf-gcc-12.3.0-lib/lib/libasan.so.8+0xbb0d8)
#1 0x7f448cb4c7cf in g_slist_remove (/nix/store/fr53rm643lg0rp4qmgzzpwsz5xxdqwk0-glib-2.76.3/lib/libglib-2.0.so.0+0x7e7cf)
#2 0x7f44877a4612 in janus_videoroom_handler plugins/janus_videoroom.c:10435
#3 0x7f448cb5864c in g_thread_proxy (/nix/store/fr53rm643lg0rp4qmgzzpwsz5xxdqwk0-glib-2.76.3/lib/libglib-2.0.so.0+0x8a64c)
previously allocated by thread T6 here:
#0 0x7f448cebc3ff in __interceptor_malloc (/nix/store/v286z87irid5vn13y2z6fphfrzmgj0kf-gcc-12.3.0-lib/lib/libasan.so.8+0xbc3ff)
#1 0x7f448cb32878 in g_malloc (/nix/store/fr53rm643lg0rp4qmgzzpwsz5xxdqwk0-glib-2.76.3/lib/libglib-2.0.so.0+0x64878)
Thread T6 created by T0 here:
#0 0x7f448ce4d136 in __interceptor_pthread_create (/nix/store/v286z87irid5vn13y2z6fphfrzmgj0kf-gcc-12.3.0-lib/lib/libasan.so.8+0x4d136)
#1 0x7f448cb85555 in g_system_thread_new (/nix/store/fr53rm643lg0rp4qmgzzpwsz5xxdqwk0-glib-2.76.3/lib/libglib-2.0.so.0+0xb7555)
SUMMARY: AddressSanitizer: heap-use-after-free plugins/janus_videoroom.c:10438 in janus_videoroom_handler
Shadow bytes around the buggy address:
0x0c0480002000: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c0480002010: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c0480002020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
0x0c0480002030: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd
0x0c0480002040: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
=>0x0c0480002050: fa fa fd fa fa fa fd fd fa fa 05 fa fa fa fd[fd]
0x0c0480002060: fa fa 02 fa fa fa 02 fa fa fa fd fd fa fa 00 00
0x0c0480002070: fa fa 02 fa fa fa 02 fa fa fa 00 00 fa fa fd fd
0x0c0480002080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c0480002090: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c04800020a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==472607==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment