CODEWITHSUNDEEP
runtime-erroraddress-sanitizeransi-c
lorenuar
lorenuar

Reputation: 41

AddressSanitizer: heap-use-after-free ANSI C

I am getting this error when I try to clear a linked list

=================================================================
==4574==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000000050 at pc 0x7fcb73b40682 bp 0x7ffffcfd8370 sp 0x7ffffcfd8368
READ of size 8 at 0x603000000050 thread T0
    #0 0x7fcb73b40681 in clear_dict ../src/utils_dict.c:83
    #1 0x7fcb73b4193c in morsec ../src/morsec.c:37
    #2 0x7fcb73b419e2 in main ../src/morsec.c:45
    #3 0x7fcb72b8409a in __libc_start_main ../csu/libc-start.c:308
    #4 0x7fcb73b40189 in _start (/mnt/c/Code/WEC-01/morsec+0x2189)

0x603000000050 is located 16 bytes inside of 24-byte region [0x603000000040,0x603000000058)
freed by thread T0 here:
    #0 0x7fcb72e18fb0 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)
    #1 0x7fcb73b405d7 in del_node ../src/utils_dict.c:70
    #2 0x7fcb73b40698 in clear_dict ../src/utils_dict.c:84
    #3 0x7fcb73b4193c in morsec ../src/morsec.c:37
    #4 0x7fcb73b419e2 in main ../src/morsec.c:45
    #5 0x7fcb72b8409a in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7fcb72e19330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)
    #1 0x7fcb73b40266 in new_node ../src/utils_dict.c:20
    #2 0x7fcb73b416aa in get_dict ../src/parser.c:50
    #3 0x7fcb73b4186d in morsec ../src/morsec.c:19
    #4 0x7fcb73b419e2 in main ../src/morsec.c:45
    #5 0x7fcb72b8409a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free ../src/utils_dict.c:83 in clear_dict
Shadow bytes around the buggy address:
  0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c067fff8000: fa fa fd fd fd fa fa fa fd fd[fd]fa fa fa 00 00
  0x0c067fff8010: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 06 fa fa 00 00 00 fa
  0x0c067fff8030: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8040: 01 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4574==ABORTING

Here are the functions I wrote, ASAN says it's in clear_dict, I tried debugging it and ASAN triggers only the third or fourth time that clear_dict is run, I really cannot get around this error

struct s_dict
{
    char            *word;
    char            *symb;
    struct s_dict   *next;
};
typedef struct s_dict t_dict;

t_dict  *new_node(char *word, char *symb)
{
    t_dict  *new;

    new = NULL;
    if (!(new = (t_dict*)malloc(sizeof(t_dict))))
        return (NULL);
    new->word = word;
    new->symb = symb;
    new->next = NULL;
    return (new);
}

void        del_node(t_dict *node)
{
    if (node->word)
        free(node->word);
    node->word = NULL;
    if (node->symb)
        free(node->symb);
    node->symb = NULL;
    if (node->next)
        free(node->next);
    node->next = NULL;
    if (node)
        free(node);
    node = NULL;
}

void        clear_dict(t_dict **chain)
{
    t_dict *tmp;

    while (chain && *chain)
    {
        tmp = (*chain)->next;            << line 83 in my code
        del_node(*chain);
        *chain = tmp;
    }
}

I don't know what's causing the error, it says 

free(): double free detected in tcache 2
[1]    4601 abort (core dumped)

when not using -fsanitize=address

thanks for taking your time.

Upvotes: 4

Views: 8930

Answers (1)

Employed Russian
Employed Russian

Reputation: 213957

The bug (actually several) is in your del_node(): it shouldn't touch the next node.

As is, it deletes node->next, orphaning node->next->word etc, and setting up for double-delete on next iteration.

P.S. This check and assignment in del_node():

    if (node)         // useless
      free(node);
    node = NULL;      // useless

are useless: if node was NULL, you would have crashed already. Assigning is useless as it modifies a local variable immediately before returning from the function.

Upvotes: 1

Related Questions