[vuln_reset_parent] Compiling variant_reset_parent.c... [vuln_reset_parent] Running reproducer... ================================================================= ==178060==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d3edc9e0950 at pc 0x556565735835 bp 0x7ffed12da880 sp 0x7ffed12da870 READ of size 8 at 0x7d3edc9e0950 thread T0 #0 0x556565735834 in priority_remove_child /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3514 #1 0x556565736048 in data_priority_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3594 #2 0x556565720186 in Curl_close /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:280 #3 0x5565656a4f41 in curl_easy_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:844 #4 0x5565656a1abb in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/variant_reset_parent.c:25 #5 0x7f1edd823600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #6 0x7f1edd823717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #7 0x5565656a1704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/reproducer_vuln_reset_parent+0x6e704) (BuildId: a60e7d3d3eaa66a79817f3da02024a58723f5e13) 0x7d3edc9e0950 is located 2128 bytes inside of 5128-byte region [0x7d3edc9e0100,0x7d3edc9e1508) freed by thread T0 here: #0 0x7f1ede2b63ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51 #1 0x5565656b5e61 in curl_dbg_free /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/memdebug.c:385 #2 0x556565720830 in Curl_close /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:315 #3 0x5565656a4f41 in curl_easy_cleanup /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:844 #4 0x5565656a1aaf in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/variant_reset_parent.c:22 #5 0x7f1edd823600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #6 0x7f1edd823717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #7 0x5565656a1704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/reproducer_vuln_reset_parent+0x6e704) (BuildId: a60e7d3d3eaa66a79817f3da02024a58723f5e13) previously allocated by thread T0 here: #0 0x7f1ede2b740f in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:74 #1 0x5565656b5ad7 in curl_dbg_calloc /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/memdebug.c:254 #2 0x556565721558 in Curl_open /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:467 #3 0x5565656a2d4b in curl_easy_init /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/easy.c:350 #4 0x5565656a19e1 in main /data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/variant_reset_parent.c:5 #5 0x7f1edd823600 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #6 0x7f1edd823717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 90ebd03ae9d9f42b23b4eb82fdf70352cf744198) #7 0x5565656a1704 in _start (/data/pruva/runs/0e70ea85-c1c7-487a-aed7-bfc14819a7d1/bundle/vuln_variant/artifacts/reproducer_vuln_reset_parent+0x6e704) (BuildId: a60e7d3d3eaa66a79817f3da02024a58723f5e13) SUMMARY: AddressSanitizer: heap-use-after-free /data/pruva/project-cache/14c9a4a2-b135-492c-b262-c0b31557861d/repo/lib/url.c:3514 in priority_remove_child Shadow bytes around the buggy address: 0x7d3edc9e0680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7d3edc9e0900: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd 0x7d3edc9e0980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d3edc9e0b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==178060==ABORTING