Open chkeita opened 3 years ago
onefuzz --endpoint https://chkeitaonefuzz2.azurewebsites.net repro create_and_connect oft-reports-cecbd958a1f257688f9768edaaf6c94d 34b35d61d6a9a35c719158fa2bdf674138af09d1d67dda7ca7c091c27bbd96b0.json
#1 0x4fd5c5 in LLVMFuzzerTestOneInput /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:43:56 #2 0x43b271 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x43b271) #3 0x423767 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x423767) #4 0x429741 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x429741) #5 0x4557a2 in main (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4557a2) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #7 0x41db59 in _start (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x41db59)
INFO: Loaded 1 modules (22 inline 8-bit counters): 22 [0x738f28, 0x738f3e), INFO: Loaded 1 PC tables (22 PCs): 22 [0x5144a8,0x514608), setup/fuzz.exe: Running 1 inputs 1 time(s) each. Running: /onefuzz/31d26042-d084-40f8-88ce-7fb847fcf606/task_crashes_1/crash-2cc7a6da1a57facb3246fad289fdff34391a8a46 ================================================================= ==4932==ERROR: AddressSanitizer: attempting double-free on 0x602000000010 in thread T0: #0 0x4cd36d in free (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4cd36d) #1 0x4fd5c5 in LLVMFuzzerTestOneInput /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:43:56 #2 0x43b271 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x43b271) #3 0x423767 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x423767) #4 0x429741 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x429741) #5 0x4557a2 in main (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4557a2) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #7 0x41db59 in _start (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x41db59) 0x602000000010 is located 0 bytes inside of 4-byte region [0x602000000010,0x602000000014) freed by thread T0 here: #0 0x4cd36d in free (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4cd36d) #1 0x4fd5b6 in LLVMFuzzerTestOneInput /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:43:47 #2 0x43b271 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x43b271) #3 0x423767 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x423767) #4 0x429741 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x429741) #5 0x4557a2 in main (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4557a2) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 previously allocated by thread T0 here: #0 0x4cd5ed in malloc (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4cd5ed) #1 0x4fd5a0 in LLVMFuzzerTestOneInput /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:43:26 #2 0x43b271 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x43b271) #3 0x423767 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x423767) #4 0x429741 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x429741) #5 0x4557a2 in main (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4557a2) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 SUMMARY: AddressSanitizer: double-free (/onefuzz/blob-containers/fuzz27ee6imdmr5gy/fuzz.exe+0x4cd36d) in free ==4932==ABORTING
Duplicate found.
Files
Repro
onefuzz --endpoint https://chkeitaonefuzz2.azurewebsites.net repro create_and_connect oft-reports-cecbd958a1f257688f9768edaaf6c94d 34b35d61d6a9a35c719158fa2bdf674138af09d1d67dda7ca7c091c27bbd96b0.json
Call Stack
ASAN Log