#1 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7)
#2 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a)
#3 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50)
#4 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52)
#5 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#6 0x41cbc9 in _start (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cbc9)
ASAN Log
INFO: Loaded 1 modules (21 inline 8-bit counters): 21 [0x788fb0, 0x788fc5),
INFO: Loaded 1 PC tables (21 PCs): 21 [0x5664c8,0x566618),
setup/fuzz: Running 1 inputs 1 time(s) each.
Running: /tmp/.tmps810lI/crash-cbe07cd3ebaba15610ecd968c4e4a04c6643e534
=================================================================
==6611==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000050 at pc 0x00000054af70 bp 0x7fffffffcff0 sp 0x7fffffffcfe8
WRITE of size 4 at 0x602000000050 thread T0
#0 0x54af6f in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:48:51
#1 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7)
#2 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a)
#3 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50)
#4 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52)
#5 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#6 0x41cbc9 in _start (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cbc9)
0x602000000050 is located 0 bytes inside of 4-byte region [0x602000000050,0x602000000054)
freed by thread T0 here:
#0 0x511f10 in free (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x511f10)
#1 0x54af29 in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:48:39
#2 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7)
#3 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a)
#4 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50)
#5 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52)
#6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
previously allocated by thread T0 here:
#0 0x5120e0 in malloc (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x5120e0)
#1 0x54af13 in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:48:18
#2 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7)
#3 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a)
#4 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50)
#5 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52)
#6 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
SUMMARY: AddressSanitizer: heap-use-after-free /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:48:51 in LLVMFuzzerTestOneInput
Shadow bytes around the buggy address:
0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c047fff8000: fa fa 04 fa fa fa 04 fa fa fa[fd]fa fa fa fa fa
0x0c047fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==6611==ABORTING
Files
Repro
onefuzz --endpoint https://oefuzzingtest2instance.azurewebsites.net repro create_and_connect oft-unique-reports-032590c6e8ea524cb32942a29c898a62 d2e1637cef455f5f82686d72b90ab419709a0105938b8e4d9c92c8136732ff8a.json
Call Stack
ASAN Log