Skip to content

WeakFromThisGracefulExitOnSessionDestroy Test UAF #123

Description

@afrind

ctest doesn't run this test for some reason? But when you run the built binary manually and ASAN on it fails:

I0331 00:40:16.570691 4020263 TestMain.cpp:16] Running tests from TestMain.cpp
Note: Google Test filter = *WeakFromThisGracefulExitOnSessionDestroy*
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from MoQSessionDeleteFromCallbackTests/MoQSessionDeleteFromCallbackTest
[ RUN      ] MoQSessionDeleteFromCallbackTests/MoQSessionDeleteFromCallbackTest.WeakFromThisGracefulExitOnSessionDestroy/0
=================================================================
==4020263==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000035118 at pc 0x000000c5e925 bp 0x7ffd43033010 sp 0x7ffd43033000
READ of size 8 at 0x503000035118 thread T0
    #0 0xc5e924 in std::__atomic_base<unsigned long>::load(std::memory_order) const /usr/include/c++/14/bits/atomic_base.h:501
    #1 0xc5e924 in folly::detail::CancellationState::isCancellationRequested() const /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken-inl.h:391
    #2 0xc5e924 in folly::CancellationSource::isCancellationRequested() const /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken-inl.h:222
    #3 0xc5e924 in moxygen::MoQSession::cleanup() /home/afrind/develop/moxygen/moxygen/MoQSession.cpp:2188
    #4 0xbf0e7e in moxygen::MoQSession::close(moxygen::SessionCloseErrorCode) /home/afrind/develop/moxygen/moxygen/MoQSession.cpp:2293
    #5 0xb6d44a in moxygen::MoQSession::onSessionEnd(folly::Optional<unsigned int>) /home/afrind/develop/moxygen/standalone/../moxygen/MoQSession.h:452
    #6 0x604219 in proxygen::test::FakeSharedWebTransport::closeSession(folly::Optional<unsigned int>) /home/afrind/develop/moxygen/_build_asan/_deps/proxygen-src/proxygen/lib/http/webtransport/test/FakeSharedWebTransport.h:359
    #7 0xbf0f27 in moxygen::MoQSession::close(moxygen::SessionCloseErrorCode) /home/afrind/develop/moxygen/moxygen/MoQSession.cpp:2295
    #8 0xa2ddc8 in co_TestBody /home/afrind/develop/moxygen/moxygen/test/MoQSessionTests.cpp:470
    #9 0x1b9c63d in std::__n4861::coroutine_handle<void>::resume() const /usr/include/c++/14/coroutine:137
    #10 0x1b9c63d in folly::resumeCoroutineWithNewAsyncStackRoot(std::__n4861::coroutine_handle<void>, folly::AsyncStackFrame&) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/tracing/AsyncStack.cpp:199
    #11 0x602191 in folly::coro::detail::co_reschedule_on_current_executor_::StackAwareAwaiter::await_suspend_impl(std::__n4861::coroutine_handle<void>, folly::AsyncStackFrame&)::{lambda()#1}::operator()() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/CurrentExecutor.h:92
    #12 0x602191 in void folly::detail::function::call_<folly::coro::detail::co_reschedule_on_current_executor_::StackAwareAwaiter::await_suspend_impl(std::__n4861::coroutine_handle<void>, folly::AsyncStackFrame&)::{lambda()#1}, true, false, void>(, folly::detail::function::Data&) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/Function.h:341
    #13 0x197dbf9 in folly::detail::function::FunctionTraits<void ()>::operator()() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/Function.h:370
    #14 0x197dbf9 in folly::EventBase::FunctionLoopCallback::runLoopCallback() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.h:188
    #15 0x195e2ce in folly::EventBase::runLoopCallbackList(boost::intrusive::list<folly::EventBase::LoopCallback, boost::intrusive::constant_time_size<false> >&, folly::EventBase::LoopCallbacksDeadline const&) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:1028
    #16 0x195ef3a in folly::EventBase::runLoopCallbacks() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:1049
    #17 0x196840f in folly::EventBase::loopMain(int, folly::EventBase::LoopOptions) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:657
    #18 0x196af6f in folly::EventBase::loopBody(int, folly::EventBase::LoopOptions) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:539
    #19 0x198b50c in non-virtual thunk to folly::EventBase::drive() (/home/afrind/develop/moxygen/_build_asan/moxygen/test/MoQSessionTests+0x198b50c) (BuildId: 6dedfbb8eaead3a57c4875e27f98c2e920c5aecd)
    #20 0x626e15 in folly::coro::detail::BlockingWaitTask<void>::getVia(folly::DrivableExecutor*, folly::AsyncStackFrame&) && /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/BlockingWait.h:230
    #21 0xa16ea1 in folly::coro::detail::decay_rvalue_reference<folly::coro::await_result<decltype (folly::coro::folly_cpo__::co_viaIfAsync((static_cast<folly::ExecutorKeepAlive<folly::Executor> (*)() noexcept>(decltype(nullptr)))(), (static_cast<folly::coro::Task<void> (*)() noexcept>(decltype(nullptr)))())), void>::type>::type folly::coro::blocking_wait_fn::operator()<folly::coro::Task<void>, 0>(folly::coro::Task<void>&&, folly::DrivableExecutor*) const /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/BlockingWait.h:402
    #22 0xa2f2eb in MoQSessionDeleteFromCallbackTest_WeakFromThisGracefulExitOnSessionDestroy_Test::TestBody() /home/afrind/develop/moxygen/moxygen/test/MoQSessionTests.cpp:424
    #23 0x7f1a091b2a01 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) [clone .constprop.0] (/lib64/libgtest.so.1.14.0+0x55a01) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)
    #24 0x7f1a0919d995 in testing::Test::Run() (/lib64/libgtest.so.1.14.0+0x40995) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)
    #25 0x7f1a0919db94 in testing::TestInfo::Run() (/lib64/libgtest.so.1.14.0+0x40b94) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)
    #26 0x7f1a0919dd9e in testing::TestSuite::Run() (/lib64/libgtest.so.1.14.0+0x40d9e) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)
    #27 0x7f1a091aa1cf in testing::internal::UnitTestImpl::RunAllTests() (/lib64/libgtest.so.1.14.0+0x4d1cf) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)
    #28 0x7f1a091aa807 in testing::UnitTest::Run() (/lib64/libgtest.so.1.14.0+0x4d807) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)
    #29 0x58166c in RUN_ALL_TESTS() /usr/include/gtest/gtest.h:2317
    #30 0x58166c in main /home/afrind/develop/moxygen/moxygen/test/TestMain.cpp:17
    #31 0x7f1a0862458d in __libc_start_call_main (/lib64/libc.so.6+0x2a58d) (BuildId: 7220aeaa72939d03bb30498143502658697f59b7)
    #32 0x7f1a08624648 in __libc_start_main_alias_2 (/lib64/libc.so.6+0x2a648) (BuildId: 7220aeaa72939d03bb30498143502658697f59b7)
    #33 0x58ac94 in _start (/home/afrind/develop/moxygen/_build_asan/moxygen/test/MoQSessionTests+0x58ac94) (BuildId: 6dedfbb8eaead3a57c4875e27f98c2e920c5aecd)

0x503000035118 is located 8 bytes inside of 32-byte region [0x503000035110,0x503000035130)
freed by thread T0 here:
    #0 0x7f1a094fe2b8 in operator delete(void*, unsigned long) (/lib64/libasan.so.8+0xfe2b8) (BuildId: 704906ef2c282931655ba79621782b22a4eaea8a)
    #1 0x610e3d in folly::detail::CancellationState::removeTokenReference() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken-inl.h:366
    #2 0x610e3d in folly::detail::CancellationState::removeTokenReference() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken-inl.h:357
    #3 0x610e3d in folly::detail::CancellationStateTokenDeleter::operator()(folly::detail::CancellationState*) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken-inl.h:125
    #4 0x610e3d in std::unique_ptr<folly::detail::CancellationState, folly::detail::CancellationStateTokenDeleter>::~unique_ptr() /usr/include/c++/14/bits/unique_ptr.h:398
    #5 0x610e3d in folly::CancellationToken::~CancellationToken() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken.h:69
    #6 0x610e3d in folly::coro::detail::BasePromise<folly::Unit>::~BasePromise() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/BasePromise.h:48
    #7 0xcc6abd in folly::coro::detail::TaskPromiseBase::~TaskPromiseBase() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/Task.h:126
    #8 0xcc6abd in folly::coro::detail::TaskPromiseCrtpBase<folly::coro::detail::TaskPromise<void>, void>::~TaskPromiseCrtpBase() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/Task.h:214
    #9 0xcc6abd in folly::coro::detail::TaskPromise<void>::~TaskPromise() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/Task.h:254
    #10 0xcc6abd in controlReadLoop /home/afrind/develop/moxygen/moxygen/MoQSession.cpp:2618
    #11 0xb9778c in std::__n4861::coroutine_handle<folly::coro::detail::TaskPromise<void> >::destroy() const /usr/include/c++/14/coroutine:244
    #12 0xb9778c in folly::coro::TaskWithExecutor<void>::Awaiter::await_resume_try()::{lambda()#1}::operator()() const /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/Task.h:526
    #13 0xb9778c in void folly::catch_exception<folly::coro::TaskWithExecutor<void>::Awaiter::await_resume_try()::{lambda()#1}&, void (*)() noexcept, , void>(folly::coro::TaskWithExecutor<void>::Awaiter::await_resume_try()::{lambda()#1}&, void (*&&)() noexcept) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/lang/Exception.h:361
    #14 0xb9778c in folly::detail::ScopeGuardImpl<folly::coro::TaskWithExecutor<void>::Awaiter::await_resume_try()::{lambda()#1}, true>::execute() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/ScopeGuard.h:181
    #15 0xb9778c in folly::detail::ScopeGuardImpl<folly::coro::TaskWithExecutor<void>::Awaiter::await_resume_try()::{lambda()#1}, true>::~ScopeGuardImpl() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/ScopeGuard.h:154
    #16 0xb9778c in folly::coro::TaskWithExecutor<void>::Awaiter::await_resume_try() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/Task.h:529
    #17 0xb9778c in folly::coro::detail::TryAwaiter<folly::coro::TaskWithExecutor<void> >::await_resume() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/ViaIfAsync.h:693
    #18 0xb9778c in startImpl /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/Task.h:437
    #19 0xcc7cec in controlReadLoop /home/afrind/develop/moxygen/moxygen/MoQSession.cpp:2571
    #20 0x1b9c63d in std::__n4861::coroutine_handle<void>::resume() const /usr/include/c++/14/coroutine:137
    #21 0x1b9c63d in folly::resumeCoroutineWithNewAsyncStackRoot(std::__n4861::coroutine_handle<void>, folly::AsyncStackFrame&) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/tracing/AsyncStack.cpp:199
    #22 0xbdf252 in folly::coro::detail::WithAsyncStackCoroutine::promise_type::FinalAwaiter::await_suspend(std::__n4861::coroutine_handle<folly::coro::detail::WithAsyncStackCoroutine::promise_type>) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/WithAsyncStack.h:52
    #23 0xbdf252 in create /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/WithAsyncStack.h:92
    #24 0x19363a8 in folly::detail::function::FunctionTraits<void (folly::futures::detail::CoreBase&, folly::ExecutorKeepAlive<folly::Executor>&&, folly::exception_wrapper*)>::operator()(folly::futures::detail::CoreBase&, folly::ExecutorKeepAlive<folly::Executor>&&, folly::exception_wrapper*) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/Function.h:370
    #25 0x19363a8 in operator() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/futures/detail/Core.cpp:622
    #26 0x19363a8 in operator() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/Executor.h:161
    #27 0x19363a8 in call_<folly::ExecutorKeepAlive<folly::Executor>::add<folly::futures::detail::CoreBase::doCallback(folly::Executor::KeepAlive<>&&, folly::futures::detail::State)::<lambda(folly::Executor::KeepAlive<>&&)> >(folly::futures::detail::CoreBase::doCallback(folly::Executor::KeepAlive<>&&, folly::futures::detail::State)::<lambda(folly::Executor::KeepAlive<>&&)>&&) &&::<lambda()>, true, false, void> /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/Function.h:341
    #28 0x197dbf9 in folly::detail::function::FunctionTraits<void ()>::operator()() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/Function.h:370
    #29 0x197dbf9 in folly::EventBase::FunctionLoopCallback::runLoopCallback() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.h:188
    #30 0x195e2ce in folly::EventBase::runLoopCallbackList(boost::intrusive::list<folly::EventBase::LoopCallback, boost::intrusive::constant_time_size<false> >&, folly::EventBase::LoopCallbacksDeadline const&) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:1028
    #31 0x195ef3a in folly::EventBase::runLoopCallbacks() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:1049
    #32 0x196840f in folly::EventBase::loopMain(int, folly::EventBase::LoopOptions) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:657
    #33 0x196af6f in folly::EventBase::loopBody(int, folly::EventBase::LoopOptions) /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/io/async/EventBase.cpp:539
    #34 0x198b50c in non-virtual thunk to folly::EventBase::drive() (/home/afrind/develop/moxygen/_build_asan/moxygen/test/MoQSessionTests+0x198b50c) (BuildId: 6dedfbb8eaead3a57c4875e27f98c2e920c5aecd)
    #35 0x626e15 in folly::coro::detail::BlockingWaitTask<void>::getVia(folly::DrivableExecutor*, folly::AsyncStackFrame&) && /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/BlockingWait.h:230
    #36 0xa16ea1 in folly::coro::detail::decay_rvalue_reference<folly::coro::await_result<decltype (folly::coro::folly_cpo__::co_viaIfAsync((static_cast<folly::ExecutorKeepAlive<folly::Executor> (*)() noexcept>(decltype(nullptr)))(), (static_cast<folly::coro::Task<void> (*)() noexcept>(decltype(nullptr)))())), void>::type>::type folly::coro::blocking_wait_fn::operator()<folly::coro::Task<void>, 0>(folly::coro::Task<void>&&, folly::DrivableExecutor*) const /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/coro/BlockingWait.h:402
    #37 0xa2f2eb in MoQSessionDeleteFromCallbackTest_WeakFromThisGracefulExitOnSessionDestroy_Test::TestBody() /home/afrind/develop/moxygen/moxygen/test/MoQSessionTests.cpp:424
    #38 0x7f1a091b2a01 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) [clone .constprop.0] (/lib64/libgtest.so.1.14.0+0x55a01) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)

previously allocated by thread T0 here:
    #0 0x7f1a094fd218 in operator new(unsigned long) (/lib64/libasan.so.8+0xfd218) (BuildId: 704906ef2c282931655ba79621782b22a4eaea8a)
    #1 0xc626e3 in folly::detail::CancellationState::create() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken-inl.h:303
    #2 0xc626e3 in folly::CancellationSource::CancellationSource() /home/afrind/develop/moxygen/_build_asan/_deps/folly-src/folly/CancellationToken-inl.h:188
    #3 0xc626e3 in moxygen::MoQSession::MoQSession(folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQExecutor>) /home/afrind/develop/moxygen/moxygen/MoQSession.cpp:2128
    #4 0xa4ad8d in moxygen::MoQRelaySession::MoQSession(folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQExecutor>) /home/afrind/develop/moxygen/standalone/../moxygen/MoQRelaySession.h:51
    #5 0xa4ad8d in void std::_Construct<moxygen::MoQRelaySession, folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&>(moxygen::MoQRelaySession*, folly::MaybeManagedPtr<proxygen::WebTransport>&&, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&) /usr/include/c++/14/bits/stl_construct.h:119
    #6 0xa4ad8d in void std::allocator_traits<std::allocator<void> >::construct<moxygen::MoQRelaySession, folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&>(std::allocator<void>&, moxygen::MoQRelaySession*, folly::MaybeManagedPtr<proxygen::WebTransport>&&, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&) /usr/include/c++/14/bits/alloc_traits.h:706
    #7 0xa4ad8d in std::_Sp_counted_ptr_inplace<moxygen::MoQRelaySession, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace<folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&>(std::allocator<void>, folly::MaybeManagedPtr<proxygen::WebTransport>&&, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&) /usr/include/c++/14/bits/shared_ptr_base.h:607
    #8 0xa4ad8d in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<moxygen::MoQRelaySession, std::allocator<void>, folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&>(moxygen::MoQRelaySession*&, std::_Sp_alloc_shared_tag<std::allocator<void> >, folly::MaybeManagedPtr<proxygen::WebTransport>&&, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&) /usr/include/c++/14/bits/shared_ptr_base.h:969
    #9 0xa4ad8d in std::__shared_ptr<moxygen::MoQRelaySession, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<void>, folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&>(std::_Sp_alloc_shared_tag<std::allocator<void> >, folly::MaybeManagedPtr<proxygen::WebTransport>&&, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&) /usr/include/c++/14/bits/shared_ptr_base.h:1713
    #10 0xa4ad8d in std::shared_ptr<moxygen::MoQRelaySession>::shared_ptr<std::allocator<void>, folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&>(std::_Sp_alloc_shared_tag<std::allocator<void> >, folly::MaybeManagedPtr<proxygen::WebTransport>&&, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&) /usr/include/c++/14/bits/shared_ptr.h:463
    #11 0xa4ad8d in std::shared_ptr<moxygen::MoQRelaySession> std::make_shared<moxygen::MoQRelaySession, folly::MaybeManagedPtr<proxygen::WebTransport>, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&>(folly::MaybeManagedPtr<proxygen::WebTransport>&&, std::shared_ptr<moxygen::MoQFollyExecutorImpl>&) /usr/include/c++/14/bits/shared_ptr.h:1008
    #12 0xab9344 in moxygen::test::MoQSessionTest::SetUp() /home/afrind/develop/moxygen/moxygen/test/MoQSessionTestCommon.cpp:175
    #13 0x7f1a091b2a01 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) [clone .constprop.0] (/lib64/libgtest.so.1.14.0+0x55a01) (BuildId: 5704ddc976bd97f5f2b38f5c0e98e1f2e4d70d3c)

SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/14/bits/atomic_base.h:501 in std::__atomic_base<unsigned long>::load(std::memory_order) const
Shadow bytes around the buggy address:
  0x503000034e80: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x503000034f00: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
  0x503000034f80: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x503000035000: fd fd fa fa fd fd fd fa fa fa fd fd fd fd fa fa
  0x503000035080: 00 00 00 fa fa fa 00 00 00 00 fa fa fd fd fd fd
=>0x503000035100: fa fa fd[fd]fd fd fa fa fd fd fd fd fa fa fd fd
  0x503000035180: fd fd fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x503000035200: 00 00 00 fa fa fa 00 00 00 fa fa fa fd fd fd fd
  0x503000035280: fa fa 00 00 00 fa fa fa fd fd fd fd fa fa fd fd
  0x503000035300: fd fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x503000035380: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4020263==ABORTING

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions