ERROR: AddressSanitizer: heap-use-after-free
==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000cf5472 at pc 0x55d4620d3245 bp 0x7ffcc0089a50 sp 0x7ffcc0089a48 READ of size 2 at 0x613000cf5472 thread T0 #0 0x55d4620d3244 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xef4244) #1 0x55d461ef26bb (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xd136bb) legacy/trac#2 (closed) 0x55d461ef244f (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xd1344f) legacy/trac#3 (closed) 0x55d461dc997e (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xbea97e) legacy/trac#4 (closed) 0x55d4619255d2 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x7465d2) legacy/trac#5 (closed) 0x55d461917088 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x738088) legacy/trac#6 (closed) 0x55d461f23213 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xd44213) legacy/trac#7 (closed) 0x55d461f1b081 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xd3c081) legacy/trac#8 (closed) 0x55d461d15dd7 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xb36dd7) legacy/trac#9 (closed) 0x55d461d4c147 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xb6d147) legacy/trac#10 (closed) 0x55d462126fef (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xf47fef) legacy/trac#11 (closed) 0x55d4621231f2 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xf441f2) legacy/trac#12 (closed) 0x55d46209db6b (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xebeb6b) legacy/trac#13 (closed) 0x55d46206a166 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe8b166) legacy/trac#14 (closed) 0x55d4620679cf (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe889cf) legacy/trac#15 (closed) 0x55d46176ef18 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x58ff18) legacy/trac#16 (closed) 0x7fb0858abc58 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/libevent-2.1.so.5+0x1fc58) legacy/trac#17 (closed) 0x7fb0858a7d01 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/libevent-2.1.so.5+0x1bd01) legacy/trac#18 (closed) 0x55d461793edf (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x5b4edf) legacy/trac#19 (closed) 0x55d461780a36 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x5a1a36) legacy/trac#20 (closed) 0x55d46177c946 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x59d946) legacy/trac#21 (closed) 0x55d461786c29 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x5a7c29) legacy/trac#22 (closed) 0x55d46176c52a (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x58d52a) legacy/trac#23 (closed) 0x7fb0844afb44 (/lib/x86_64-linux-gnu/libc.so.6+0x21b44) legacy/trac#24 (closed) 0x55d4616c1216 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x4e2216)
0x613000cf5472 is located 114 bytes inside of 328-byte region [0x613000cf5400,0x613000cf5548) freed by thread T0 here: #0 0x55d461747f32 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x568f32) #1 0x55d462034722 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe55722) legacy/trac#2 (closed) 0x55d46202a6cd (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe4b6cd) legacy/trac#3 (closed) 0x55d46179c7cf (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x5bd7cf) legacy/trac#4 (closed) 0x55d4617a0bea (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x5c1bea) legacy/trac#5 (closed) 0x55d46179b4c8 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x5bc4c8) legacy/trac#6 (closed) 0x55d46176f81d (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x59081d) legacy/trac#7 (closed) 0x7fb0858abc58 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/libevent-2.1.so.5+0x1fc58)
previously allocated by thread T0 here: #0 0x55d461748212 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x569212) #1 0x55d4625ba9af (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x13db9af) legacy/trac#2 (closed) 0x55d4625bac68 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x13dbc68) legacy/trac#3 (closed) 0x55d4620264ca (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe474ca) legacy/trac#4 (closed) 0x55d4620280ba (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe490ba) legacy/trac#5 (closed) 0x55d462094402 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xeb5402) legacy/trac#6 (closed) 0x55d4620683ca (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe893ca) legacy/trac#7 (closed) 0x55d4620679cf (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xe889cf) legacy/trac#8 (closed) 0x55d46176ef18 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x58ff18) legacy/trac#9 (closed) 0x7fb0858abc58 (/home/cypherpunks/tor-browser_en-US/Browser/TorBrowser/Tor/libevent-2.1.so.5+0x1fc58)
Shadow bytes around the buggy address: 0x0c2680196a30: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x0c2680196a40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2680196a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2680196a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2680196a70: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2680196a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x0c2680196a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2680196aa0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x0c2680196ab0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2680196ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2680196ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==12345==ABORTING
tor-0.2.7.3-rc-467-ga03469aa