[Bug gdb/18811] New: AddressSanitizer __interceptor_setlocale, READ of size 2

[rs at revskills dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=18811

Bug ID: 18811
Summary: AddressSanitizer __interceptor_setlocale, READ of size
2
Product: gdb
Version: unknown
Status: NEW
Severity: normal
Priority: P2
Component: gdb
Assignee: unassigned at sourceware dot org
Reporter: rs at revskills dot cz
Target Milestone: ---

Tested in: GNU gdb (Ubuntu 7.9-1ubuntu1) 7.9

LD_PRELOAD asan and: gdb -v

=================================================================
==17690==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000007e40
at pc 0x7ff65d4fd3bd bp 0x7ffceed5f720 sp 0x7ffceed5f6f0
READ of size 2 at 0x610000007e40 thread T0
#0 0x7ff65d4fd3bc in __interceptor_setlocale
(/usr/lib/x86_64-linux-gnu/libasan.so.1+0x343bc)
#1 0x4f7925 in _initialize_python (/usr/bin/gdb+0x4f7925)
#2 0x6bb016 in initialize_all_files (/usr/bin/gdb+0x6bb016)
#3 0x680298 in gdb_init (/usr/bin/gdb+0x680298)
#4 0x5b409c (/usr/bin/gdb+0x5b409c)
#5 0x5b0894 in catch_errors (/usr/bin/gdb+0x5b0894)
#6 0x5b4d1a in gdb_main (/usr/bin/gdb+0x5b4d1a)
#7 0x4591d4 in main (/usr/bin/gdb+0x4591d4)
#8 0x7ff65b276a3f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
#9 0x459218 in _start (/usr/bin/gdb+0x459218)

0x610000007e40 is located 0 bytes inside of 181-byte region
[0x610000007e40,0x610000007ef5)
freed by thread T0 here:
#0 0x7ff65d5205af in __interceptor_free
(/usr/lib/x86_64-linux-gnu/libasan.so.1+0x575af)
#1 0x7ff65b281c4e in setlocale (/lib/x86_64-linux-gnu/libc.so.6+0x2bc4e)
#2 0x60200003a22f (+0x3a22f)

previously allocated by thread T0 here:
#0 0x7ff65d520827 in __interceptor_malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.1+0x57827)
#1 0x7ff65b2811f7 (/lib/x86_64-linux-gnu/libc.so.6+0x2b1f7)

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_setlocale
Shadow bytes around the buggy address:
0x0c207fff8f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05
0x0c207fff8f80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c207fff8f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06
0x0c207fff8fa0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c207fff8fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05
=>0x0c207fff8fc0: fa fa fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd
0x0c207fff8fd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x0c207fff8fe0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c207fff8ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c207fff9000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c207fff9010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==17690==ABORTING

[tromey at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=18811

Tom Tromey <tromey at sourceware dot org> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |tromey at sourceware dot org
Resolution|--- |FIXED

--- Comment #1 from Tom Tromey <tromey at sourceware dot org> ---
I think this was fixed a while ago by:

commit 86f1abec458df24ea7d4a38a7b3e21861c5b9bd8
Author: Pedro Alves <***@redhat.com>
Date: Tue May 3 12:16:56 2016 +0100

Fix gdb/python/python.c use-after-free