Skip to content

Heap-use-after-free during the make check #23

@asarubbo

Description

@asarubbo
PASS: check_list
../build-aux/test-driver: line 107:  2901 Aborted                 "$@" > $log_file 2>&1
FAIL: check_cwatch
PASS: check_commandline
============================================================================
Testsuite summary for cwatch 1.2 experimental
============================================================================
# TOTAL: 3
# PASS:  2
# SKIP:  0
# XFAIL: 0
# FAIL:  1
# XPASS: 0
# ERROR: 0
==2901==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000002180 at pc 0x00000054a362 bp 0x7ffcd4efab60 sp 0x7ffcd4efab58                                                        
READ of size 8 at 0x603000002180 thread T0                                                                                                                                                     
    #0 0x54a361 in remove_orphan_watched_resources /tmp/cwatch/src/cwatch.c                                                                                                                    
    #1 0x549893 in remove_unreachable_resources /tmp/cwatch/src/cwatch.c:893:9                                                                                                                 
    #2 0x54a51b in unwatch_symlink /tmp/cwatch/src/cwatch.c:978:9                                                                                                                              
    #3 0x50a3d2 in unwatch_an_outside_directory_removing_a_symlink_inside /tmp/cwatch/tests/check_cwatch.c:511:5
    #4 0x7fca70838efb in tcase_run_tfun_nofork /tmp/portage/dev-libs/check-0.9.11/work/check-0.9.11/src/check_run.c:328
    #5 0x7fca708391e1 in srunner_iterate_tcase_tfuns /tmp/portage/dev-libs/check-0.9.11/work/check-0.9.11/src/check_run.c:187
    #6 0x7fca708391e1 in srunner_run_tcase /tmp/portage/dev-libs/check-0.9.11/work/check-0.9.11/src/check_run.c:314
    #7 0x7fca708391e1 in srunner_iterate_suites /tmp/portage/dev-libs/check-0.9.11/work/check-0.9.11/src/check_run.c:156
    #8 0x7fca708391e1 in srunner_run /tmp/portage/dev-libs/check-0.9.11/work/check-0.9.11/src/check_run.c:626
    #9 0x50b3f0 in main /tmp/cwatch/tests/check_cwatch.c:636:5
    #10 0x7fca6f979680 in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289
    #11 0x419e48 in _start (/tmp/cwatch/tests/check_cwatch+0x419e48)

0x603000002180 is located 16 bytes inside of 24-byte region [0x603000002170,0x603000002188)
freed by thread T0 here:
    #0 0x4cf640 in __interceptor_cfree.localalias.1 /tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.0/work/compiler-rt-4.0.0.src/lib/asan/asan_malloc_linux.cc:55
    #1 0x549fcb in remove_orphan_watched_resources /tmp/cwatch/src/cwatch.c:950:13
    #2 0x549893 in remove_unreachable_resources /tmp/cwatch/src/cwatch.c:893:9
    #3 0x54a51b in unwatch_symlink /tmp/cwatch/src/cwatch.c:978:9
    #4 0x50a3d2 in unwatch_an_outside_directory_removing_a_symlink_inside /tmp/cwatch/tests/check_cwatch.c:511:5
    #5 0x7fca70838efb in tcase_run_tfun_nofork /tmp/portage/dev-libs/check-0.9.11/work/check-0.9.11/src/check_run.c:328

previously allocated by thread T0 here:
    #0 0x4cf7f8 in __interceptor_malloc /tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.0/work/compiler-rt-4.0.0.src/lib/asan/asan_malloc_linux.cc:66
    #1 0x5432f0 in list_push /tmp/cwatch/src/list.c:42:37
    #2 0x548cf5 in add_to_watch_list /tmp/cwatch/src/cwatch.c:817:20
    #3 0x50a3c0 in unwatch_an_outside_directory_removing_a_symlink_inside /tmp/cwatch/tests/check_cwatch.c:509:5
    #4 0x7fca70838efb in tcase_run_tfun_nofork /tmp/portage/dev-libs/check-0.9.11/work/check-0.9.11/src/check_run.c:328

SUMMARY: AddressSanitizer: heap-use-after-free /tmp/cwatch/src/cwatch.c in remove_orphan_watched_resources
Shadow bytes around the buggy address:
  0x0c067fff83e0: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fd
  0x0c067fff83f0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8400: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c067fff8410: fd fd fd fd fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fff8420: fa fa fd fd fd fd fa fa 00 00 00 fa fa fa fd fd
=>0x0c067fff8430:[fd]fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa
  0x0c067fff8440: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2901==ABORTING
FAIL check_cwatch (exit status: 134)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions