[vuln_duphandle] Compiling variant_duphandle.c... [vuln_duphandle] Running reproducer... ================================================================= ==178024==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b752de00a80 at pc 0x561ca9734fb1 bp 0x7ffc631cc310 sp 0x7ffc631cc300 READ of size 8 at 0x7b752de00a80 thread T0 #0 0x561ca9734fb0 in data_priority_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3587 #1 0x561ca971f1eb in Curl_close /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:280 #2 0x561ca96a3fa6 in curl_easy_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:844 #3 0x561ca96a0b20 in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/variant_duphandle.c:35 #4 0x7f452ed2f600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #5 0x7f452ed2f717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #6 0x561ca96a0704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/reproducer_vuln_duphandle+0x6e704) (BuildId: dba1c298c0c4df8b2f218867e5d82567e3c85a5b) 0x7b752de00a80 is located 16 bytes inside of 32-byte region [0x7b752de00a70,0x7b752de00a90) freed by thread T0 here: #0 0x7f452f7c23ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51 #1 0x561ca96b4ec6 in curl_dbg_free /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/memdebug.c:385 #2 0x561ca9734a18 in priority_remove_child /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3525 #3 0x561ca97350ad in data_priority_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3594 #4 0x561ca971f1eb in Curl_close /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:280 #5 0x561ca96a3fa6 in curl_easy_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:844 #6 0x561ca96a0b08 in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/variant_duphandle.c:29 #7 0x7f452ed2f600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #8 0x7f452ed2f717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #9 0x561ca96a0704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/reproducer_vuln_duphandle+0x6e704) (BuildId: dba1c298c0c4df8b2f218867e5d82567e3c85a5b) previously allocated by thread T0 here: #0 0x7f452f7c340f in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:74 #1 0x561ca96b4b3c in curl_dbg_calloc /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/memdebug.c:254 #2 0x561ca9734b32 in Curl_data_priority_add_child /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3544 #3 0x561ca970ab6a in setopt_pointers /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/setopt.c:1521 #4 0x561ca9710fba in Curl_vsetopt /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/setopt.c:2893 #5 0x561ca9711417 in curl_easy_setopt /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/setopt.c:2927 #6 0x561ca96a0a9a in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/variant_duphandle.c:17 #7 0x7f452ed2f600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #8 0x7f452ed2f717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #9 0x561ca96a0704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/reproducer_vuln_duphandle+0x6e704) (BuildId: dba1c298c0c4df8b2f218867e5d82567e3c85a5b) SUMMARY: AddressSanitizer: heap-use-after-free /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3587 in data_priority_cleanup Shadow bytes around the buggy address: 0x7b752de00800: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x7b752de00880: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00 0x7b752de00900: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 0x7b752de00980: 00 00 00 00 fa fa fd fd fd fd fa fa fd fd fd fd 0x7b752de00a00: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa fd fd =>0x7b752de00a80:[fd]fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b752de00b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b752de00b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b752de00c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b752de00c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b752de00d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==178024==ABORTING