Open mrragava opened 3 years ago
onefuzz --endpoint https://oefuzzingtest2instance.azurewebsites.net repro create_and_connect oft-unique-reports-032590c6e8ea524cb32942a29c898a62 ba91e839e8f95e03720e0931d5f2bd1252018375e77864afe3c6b6954e556f43.json
#1 0x54aee7 in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:43:48 #2 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7) #3 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a) #4 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50) #5 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #7 0x41cbc9 in _start (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cbc9)
INFO: Loaded 1 modules (21 inline 8-bit counters): 21 [0x788fb0, 0x788fc5), INFO: Loaded 1 PC tables (21 PCs): 21 [0x5664c8,0x566618), setup/fuzz: Running 1 inputs 1 time(s) each. Running: /tmp/.tmpr9SyEG/crash-689851b25449310cabd52b68acb21e7dd5fdfad0 ================================================================= ==6563==ERROR: AddressSanitizer: attempting double-free on 0x602000000050 in thread T0: #0 0x511f10 in free (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x511f10) #1 0x54aee7 in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:43:48 #2 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7) #3 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a) #4 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50) #5 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #7 0x41cbc9 in _start (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cbc9) 0x602000000050 is located 0 bytes inside of 4-byte region [0x602000000050,0x602000000054) freed by thread T0 here: #0 0x511f10 in free (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x511f10) #1 0x54aed8 in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:43:39 #2 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7) #3 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a) #4 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50) #5 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 previously allocated by thread T0 here: #0 0x5120e0 in malloc (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x5120e0) #1 0x54aec2 in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:43:18 #2 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7) #3 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a) #4 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50) #5 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52) #6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 SUMMARY: AddressSanitizer: double-free (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x511f10) in free ==6563==ABORTING
Duplicate found.
Files
Repro
onefuzz --endpoint https://oefuzzingtest2instance.azurewebsites.net repro create_and_connect oft-unique-reports-032590c6e8ea524cb32942a29c898a62 ba91e839e8f95e03720e0931d5f2bd1252018375e77864afe3c6b6954e556f43.json
Call Stack
ASAN Log