[vuln] Compiling reproducer... [vuln] Running reproducer... ================================================================= ==147869==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ddc4efe2148 at pc 0x55a87fcdc86b bp 0x7ffe2153e730 sp 0x7ffe2153e720 READ of size 8 at 0x7ddc4efe2148 thread T0 #0 0x55a87fcdc86a in priority_remove_child /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3516 #1 0x55a87fcdcf66 in data_priority_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3588 #2 0x55a87fcc7186 in Curl_close /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:280 #3 0x55a87fc4bf41 in curl_easy_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:844 #4 0x55a87fc48abb in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/repro/reproducer.c:22 #5 0x7fbc4fe61600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #6 0x7fbc4fe61717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #7 0x55a87fc48704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/repro/reproducer_vuln+0x6e704) (BuildId: 49ee29f5081e5b4c91f1f0de1d37f0fe0c150240) 0x7ddc4efe2148 is located 2120 bytes inside of 5128-byte region [0x7ddc4efe1900,0x7ddc4efe2d08) freed by thread T0 here: #0 0x7fbc508f43ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51 #1 0x55a87fc5ce61 in curl_dbg_free /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/memdebug.c:385 #2 0x55a87fcc7830 in Curl_close /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:315 #3 0x55a87fc4bf41 in curl_easy_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:844 #4 0x55a87fc48aaf in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/repro/reproducer.c:20 #5 0x7fbc4fe61600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #6 0x7fbc4fe61717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #7 0x55a87fc48704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/repro/reproducer_vuln+0x6e704) (BuildId: 49ee29f5081e5b4c91f1f0de1d37f0fe0c150240) previously allocated by thread T0 here: #0 0x7fbc508f540f in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:74 #1 0x55a87fc5cad7 in curl_dbg_calloc /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/memdebug.c:254 #2 0x55a87fcc8558 in Curl_open /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:467 #3 0x55a87fc49d4b in curl_easy_init /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:350 #4 0x55a87fc489ea in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/repro/reproducer.c:6 #5 0x7fbc4fe61600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #6 0x7fbc4fe61717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #7 0x55a87fc48704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/repro/reproducer_vuln+0x6e704) (BuildId: 49ee29f5081e5b4c91f1f0de1d37f0fe0c150240) SUMMARY: AddressSanitizer: heap-use-after-free /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3516 in priority_remove_child Shadow bytes around the buggy address: 0x7ddc4efe1e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe1f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe1f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe2000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe2080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7ddc4efe2100: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd 0x7ddc4efe2180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe2200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe2300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddc4efe2380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==147869==ABORTING