[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [Libevent-users] upcoming 2.1.4-alpha Libevent release

To: libevent-users@xxxxxxxxxxxxx
Subject: Re: [Libevent-users] upcoming 2.1.4-alpha Libevent release
From: Jeffrey Walton <noloader@xxxxxxxxx>
Date: Mon, 17 Mar 2014 14:46:37 -0400
Delivered-to: archiver@xxxxxxxx
Delivered-to: libevent-users-outgoing@xxxxxxxx
Delivered-to: libevent-users@xxxxxxxx
Delivery-date: Mon, 17 Mar 2014 14:46:45 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:content-type; bh=vy5fsrUoqWNKln+hebmveo/GpDWtV8kmIuEr4miqDGg=; b=hB3bc62PhAgmL5ud8HNBp/DoDxInB/I+TeVNTOzzH7LEO70yvqES606cA2F2/N4W+Z ZsU1m9J/xnHMGjUp1UcC9kXWuj+l1OEvUxukYOViZpS0aZdGpydbH9Q7MJhD+37hF/6Y iJ7irgDHzBlOXYEY5XAAyyJIwbch3B8npegAcNVNp/JPHN7aiqv5LRcMSlDcxUKAR0KX N6UxfeyvIZtXmMxrNERftp1dk9FN3b2xOkaj8Uy9JPQdMeQMxzhROPOyQ3wAim8wEp7V 8xTs+/6tskLiYJ/ljrvkf7dPoEoJsiqszb/Zm7yPseUuO5DijRycETfJLO+wB63iMT0S BPKg==
In-reply-to: <CAKDKvuzC8x5D_Z4XPDo-YhkWy1dxq8O37vzaJHfQHf1fcy2cqg@xxxxxxxxxxxxxx>
References: <CAKDKvuzC8x5D_Z4XPDo-YhkWy1dxq8O37vzaJHfQHf1fcy2cqg@xxxxxxxxxxxxxx>
Reply-to: libevent-users@xxxxxxxxxxxxx
Sender: owner-libevent-users@xxxxxxxxxxxxx

On Mon, Mar 17, 2014 at 1:31 PM, Nick Mathewson <nickm@xxxxxxxxxxxxx> wrote:
> Hi, all!
>
> There's been a lot of activity on Libevent recently, so I'm hoping to
> put out a Libevent 2.1.4-alpha in the next day or two.  It will not
> have every bugfix that I've been told about, or every feature that I'm
> hoping to include in 2.1.x, but it's been long enough without an alpha
> that it's probably wise to put a
>
> If you want to try it out before the release, have a look at
>
> http://www.wangafu.net/~nickm/volatile/libevent-2.1.4-alpha-candidate.tar.gz
>
> Please let me know about any total showstopper bugs here.  (Like,
> major regressions against 2.1.3-alpha)
It looks like there's some memory errors present.

Attached is the result of manually running test/test.sh.

Jeff

***** Excerpt *****

=================================================================
==8816==ERROR: AddressSanitizer: heap-use-after-free on address
0x60c000035ed3 at pc 0x7f2221d81a4d bp 0x7fff68c1bd30 sp
0x7fff68c1bd28
READ of size 1 at 0x60c000035ed3 thread T0
    #0 0x7f2221d81a4c in event_process_active_single_queue
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
    #1 0x7f2221d4b772 in event_process_active
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #2 0x7f2221d42f5e in event_base_loop
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #3 0x7f2221d417ba in event_base_dispatch
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #4 0x6494d1 in test_fin_within_cb
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #5 0x751250 in testcase_run_bare_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #6 0x750487 in testcase_run_forked_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #7 0x74fa36 in testcase_run_one
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #8 0x75420b in tinytest_main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #9 0x6dbaf1 in main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #10 0x7f222019eeac in __libc_start_main
/home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #11 0x49133c in _start
(/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x60c000035ed3 is located 19 bytes inside of 128-byte region
[0x60c000035ec0,0x60c000035f40)
freed by thread T0 here:
    #0 0x47b0e9 in __interceptor_free
/home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7f2221d23dab in event_mm_free_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3441
    #2 0x7f2221d554ce in event_free
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2110
    #3 0x64b94b in event_finalize_callback_2
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:241
    #4 0x7f2221d817a8 in event_process_active_single_queue
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1592
    #5 0x7f2221d4b772 in event_process_active
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #6 0x7f2221d42f5e in event_base_loop
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #7 0x7f2221d417ba in event_base_dispatch
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #8 0x6494d1 in test_fin_within_cb
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #9 0x751250 in testcase_run_bare_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #10 0x750487 in testcase_run_forked_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #11 0x74fa36 in testcase_run_one
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #12 0x75420b in tinytest_main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #13 0x6dbaf1 in main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #14 0x7f222019eeac in __libc_start_main
/home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

previously allocated by thread T0 here:
    #0 0x47b269 in malloc
/home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x7f2221d2391e in event_mm_malloc_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3366
    #2 0x7f2221d54d48 in event_new
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2089
    #3 0x6492b5 in test_fin_within_cb
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:262
    #4 0x751250 in testcase_run_bare_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #5 0x750487 in testcase_run_forked_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #6 0x74fa36 in testcase_run_one
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #7 0x75420b in tinytest_main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #8 0x6dbaf1 in main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #9 0x7f222019eeac in __libc_start_main
/home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

SUMMARY: AddressSanitizer: heap-use-after-free
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
event_process_active_single_queue
Shadow bytes around the buggy address:
  0x0c187fffeb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fffebd0: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c187fffebe0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffebf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffec00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffec10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffec20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8816==ABORTING


=================================================================
==8746==ERROR: AddressSanitizer: global-buffer-overflow on address
0x000000798829 at pc 0x7f2221c91b00 bp 0x7fff68c1b410 sp
0x7fff68c1b408
READ of size 42 at 0x000000798829 thread T0
    #0 0x7f2221c91aff in evbuffer_add
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
    #1 0x58813d in test_evbuffer_add_reference
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_buffer.c:1663
    #2 0x751250 in testcase_run_bare_
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #3 0x74fad1 in testcase_run_one
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:252
    #4 0x75420b in tinytest_main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #5 0x6dbaf1 in main
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #6 0x7f222019eeac in __libc_start_main
/home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #7 0x49133c in _start
(/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x000000798829 is located 55 bytes to the left of global variable
'.str258' from 'test/regress_buffer.c' (0x798860) of size 30
  '.str258' is ascii string 'ref_done_cb_called_count == 3'
0x000000798829 is located 6 bytes to the right of global variable
'.str257' from 'test/regress_buffer.c' (0x798800) of size 35
  '.str257' is ascii string '. Nothing comes and then a lot'll.'
SUMMARY: AddressSanitizer: global-buffer-overflow
/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
evbuffer_add
Shadow bytes around the buggy address:
  0x0000800eb0b0: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
  0x0000800eb0c0: 03 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb0d0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb0e0: f9 f9 f9 f9 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000800eb0f0: 00 00 00 01 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
=>0x0000800eb100: 00 00 00 00 03[f9]f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb110: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
  0x0000800eb120: 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb130: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x0000800eb140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800eb150: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8746==ABORTING

$ test/test.sh 
Running tests:
EPOLL (timerfd)
 test-eof: OKAY
 test-closed: OKAY
 test-weof: OKAY
 test-time: OKAY
 test-changelist: OKAY
 test-fdleak: OKAY
 test-dumpevents: OKAY
 regress: =================================================================
==7804==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000035ed3 at pc 0x7fabc2e08a4d bp 0x7fff0f5c5710 sp 0x7fff0f5c5708
READ of size 1 at 0x60c000035ed3 thread T0
    #0 0x7fabc2e08a4c in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
    #1 0x7fabc2dd2772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #2 0x7fabc2dc9f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #3 0x7fabc2dc87ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #4 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #5 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #6 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #7 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #8 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #9 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #10 0x7fabc1225eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #11 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x60c000035ed3 is located 19 bytes inside of 128-byte region [0x60c000035ec0,0x60c000035f40)
freed by thread T0 here:
    #0 0x47b0e9 in __interceptor_free /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7fabc2daadab in event_mm_free_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3441
    #2 0x7fabc2ddc4ce in event_free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2110
    #3 0x64b94b in event_finalize_callback_2 /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:241
    #4 0x7fabc2e087a8 in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1592
    #5 0x7fabc2dd2772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #6 0x7fabc2dc9f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #7 0x7fabc2dc87ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #8 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #9 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #10 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #11 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #12 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #13 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #14 0x7fabc1225eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

previously allocated by thread T0 here:
    #0 0x47b269 in malloc /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x7fabc2daa91e in event_mm_malloc_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3366
    #2 0x7fabc2ddbd48 in event_new /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2089
    #3 0x6492b5 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:262
    #4 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #5 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #6 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #7 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #8 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #9 0x7fabc1225eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

SUMMARY: AddressSanitizer: heap-use-after-free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594 event_process_active_single_queue
Shadow bytes around the buggy address:
  0x0c187fffeb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fffebd0: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c187fffebe0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffebf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffec00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffec10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffec20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==7804==ABORTING
[Lost connection!] 
  [within_cb FAILED]
=================================================================
==7734==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000798829 at pc 0x7fabc2d18b00 bp 0x7fff0f5c4df0 sp 0x7fff0f5c4de8
READ of size 42 at 0x000000798829 thread T0
    #0 0x7fabc2d18aff in evbuffer_add /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
    #1 0x58813d in test_evbuffer_add_reference /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_buffer.c:1663
    #2 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #3 0x74fad1 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:252
    #4 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #5 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #6 0x7fabc1225eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #7 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x000000798829 is located 55 bytes to the left of global variable '.str258' from 'test/regress_buffer.c' (0x798860) of size 30
  '.str258' is ascii string 'ref_done_cb_called_count == 3'
0x000000798829 is located 6 bytes to the right of global variable '.str257' from 'test/regress_buffer.c' (0x798800) of size 35
  '.str257' is ascii string '. Nothing comes and then a lot'll.'
SUMMARY: AddressSanitizer: global-buffer-overflow /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775 evbuffer_add
Shadow bytes around the buggy address:
  0x0000800eb0b0: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
  0x0000800eb0c0: 03 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb0d0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb0e0: f9 f9 f9 f9 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000800eb0f0: 00 00 00 01 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
=>0x0000800eb100: 00 00 00 00 03[f9]f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb110: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
  0x0000800eb120: 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb130: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x0000800eb140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800eb150: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==7734==ABORTING
FAILED
EPOLL (changelist)
 test-eof: OKAY
 test-closed: OKAY
 test-weof: OKAY
 test-time: OKAY
 test-changelist: OKAY
 test-fdleak: OKAY
 test-dumpevents: OKAY
 regress: =================================================================
==7997==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000035ed3 at pc 0x7fdd67ef4a4d bp 0x7fff5ed0ce50 sp 0x7fff5ed0ce48
READ of size 1 at 0x60c000035ed3 thread T0
    #0 0x7fdd67ef4a4c in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
    #1 0x7fdd67ebe772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #2 0x7fdd67eb5f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #3 0x7fdd67eb47ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #4 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #5 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #6 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #7 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #8 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #9 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #10 0x7fdd66311eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #11 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x60c000035ed3 is located 19 bytes inside of 128-byte region [0x60c000035ec0,0x60c000035f40)
freed by thread T0 here:
    #0 0x47b0e9 in __interceptor_free /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7fdd67e96dab in event_mm_free_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3441
    #2 0x7fdd67ec84ce in event_free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2110
    #3 0x64b94b in event_finalize_callback_2 /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:241
    #4 0x7fdd67ef47a8 in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1592
    #5 0x7fdd67ebe772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #6 0x7fdd67eb5f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #7 0x7fdd67eb47ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #8 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #9 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #10 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #11 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #12 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #13 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #14 0x7fdd66311eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

previously allocated by thread T0 here:
    #0 0x47b269 in malloc /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x7fdd67e9691e in event_mm_malloc_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3366
    #2 0x7fdd67ec7d48 in event_new /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2089
    #3 0x6492b5 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:262
    #4 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #5 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #6 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #7 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #8 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #9 0x7fdd66311eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

SUMMARY: AddressSanitizer: heap-use-after-free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594 event_process_active_single_queue
Shadow bytes around the buggy address:
  0x0c187fffeb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fffebd0: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c187fffebe0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffebf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffec00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffec10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffec20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==7997==ABORTING
[Lost connection!] 
  [within_cb FAILED]
=================================================================
==7927==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000798829 at pc 0x7fdd67e04b00 bp 0x7fff5ed0c530 sp 0x7fff5ed0c528
READ of size 42 at 0x000000798829 thread T0
    #0 0x7fdd67e04aff in evbuffer_add /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
    #1 0x58813d in test_evbuffer_add_reference /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_buffer.c:1663
    #2 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #3 0x74fad1 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:252
    #4 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #5 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #6 0x7fdd66311eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #7 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x000000798829 is located 55 bytes to the left of global variable '.str258' from 'test/regress_buffer.c' (0x798860) of size 30
  '.str258' is ascii string 'ref_done_cb_called_count == 3'
0x000000798829 is located 6 bytes to the right of global variable '.str257' from 'test/regress_buffer.c' (0x798800) of size 35
  '.str257' is ascii string '. Nothing comes and then a lot'll.'
SUMMARY: AddressSanitizer: global-buffer-overflow /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775 evbuffer_add
Shadow bytes around the buggy address:
  0x0000800eb0b0: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
  0x0000800eb0c0: 03 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb0d0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb0e0: f9 f9 f9 f9 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000800eb0f0: 00 00 00 01 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
=>0x0000800eb100: 00 00 00 00 03[f9]f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb110: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
  0x0000800eb120: 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb130: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x0000800eb140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800eb150: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==7927==ABORTING
FAILED
EPOLL (timerfd+changelist)
 test-eof: OKAY
 test-closed: OKAY
 test-weof: OKAY
 test-time: OKAY
 test-changelist: OKAY
 test-fdleak: OKAY
 test-dumpevents: OKAY
 regress: =================================================================
==8190==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000035ed3 at pc 0x7f89d3078a4d bp 0x7fffc7c7da10 sp 0x7fffc7c7da08
READ of size 1 at 0x60c000035ed3 thread T0
    #0 0x7f89d3078a4c in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
    #1 0x7f89d3042772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #2 0x7f89d3039f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #3 0x7f89d30387ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #4 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #5 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #6 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #7 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #8 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #9 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #10 0x7f89d1495eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #11 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x60c000035ed3 is located 19 bytes inside of 128-byte region [0x60c000035ec0,0x60c000035f40)
freed by thread T0 here:
    #0 0x47b0e9 in __interceptor_free /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7f89d301adab in event_mm_free_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3441
    #2 0x7f89d304c4ce in event_free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2110
    #3 0x64b94b in event_finalize_callback_2 /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:241
    #4 0x7f89d30787a8 in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1592
    #5 0x7f89d3042772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #6 0x7f89d3039f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #7 0x7f89d30387ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #8 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #9 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #10 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #11 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #12 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #13 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #14 0x7f89d1495eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

previously allocated by thread T0 here:
    #0 0x47b269 in malloc /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x7f89d301a91e in event_mm_malloc_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3366
    #2 0x7f89d304bd48 in event_new /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2089
    #3 0x6492b5 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:262
    #4 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #5 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #6 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #7 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #8 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #9 0x7f89d1495eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

SUMMARY: AddressSanitizer: heap-use-after-free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594 event_process_active_single_queue
Shadow bytes around the buggy address:
  0x0c187fffeb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fffebd0: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c187fffebe0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffebf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffec00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffec10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffec20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8190==ABORTING
[Lost connection!] 
  [within_cb FAILED]
=================================================================
==8120==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000798829 at pc 0x7f89d2f88b00 bp 0x7fffc7c7d0f0 sp 0x7fffc7c7d0e8
READ of size 42 at 0x000000798829 thread T0
    #0 0x7f89d2f88aff in evbuffer_add /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
    #1 0x58813d in test_evbuffer_add_reference /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_buffer.c:1663
    #2 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #3 0x74fad1 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:252
    #4 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #5 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #6 0x7f89d1495eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #7 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x000000798829 is located 55 bytes to the left of global variable '.str258' from 'test/regress_buffer.c' (0x798860) of size 30
  '.str258' is ascii string 'ref_done_cb_called_count == 3'
0x000000798829 is located 6 bytes to the right of global variable '.str257' from 'test/regress_buffer.c' (0x798800) of size 35
  '.str257' is ascii string '. Nothing comes and then a lot'll.'
SUMMARY: AddressSanitizer: global-buffer-overflow /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775 evbuffer_add
Shadow bytes around the buggy address:
  0x0000800eb0b0: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
  0x0000800eb0c0: 03 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb0d0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb0e0: f9 f9 f9 f9 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000800eb0f0: 00 00 00 01 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
=>0x0000800eb100: 00 00 00 00 03[f9]f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb110: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
  0x0000800eb120: 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb130: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x0000800eb140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800eb150: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8120==ABORTING
FAILED
EVPORT 
Skipping test
KQUEUE 
Skipping test
EPOLL 
 test-eof: OKAY
 test-closed: OKAY
 test-weof: OKAY
 test-time: OKAY
 test-changelist: OKAY
 test-fdleak: OKAY
 test-dumpevents: OKAY
 regress: =================================================================
==8413==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000035ed3 at pc 0x7faef46e6a4d bp 0x7fffeecddd50 sp 0x7fffeecddd48
READ of size 1 at 0x60c000035ed3 thread T0
    #0 0x7faef46e6a4c in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
    #1 0x7faef46b0772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #2 0x7faef46a7f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #3 0x7faef46a67ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #4 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #5 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #6 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #7 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #8 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #9 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #10 0x7faef2b03eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #11 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x60c000035ed3 is located 19 bytes inside of 128-byte region [0x60c000035ec0,0x60c000035f40)
freed by thread T0 here:
    #0 0x47b0e9 in __interceptor_free /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7faef4688dab in event_mm_free_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3441
    #2 0x7faef46ba4ce in event_free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2110
    #3 0x64b94b in event_finalize_callback_2 /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:241
    #4 0x7faef46e67a8 in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1592
    #5 0x7faef46b0772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #6 0x7faef46a7f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #7 0x7faef46a67ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #8 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #9 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #10 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #11 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #12 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #13 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #14 0x7faef2b03eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

previously allocated by thread T0 here:
    #0 0x47b269 in malloc /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x7faef468891e in event_mm_malloc_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3366
    #2 0x7faef46b9d48 in event_new /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2089
    #3 0x6492b5 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:262
    #4 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #5 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #6 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #7 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #8 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #9 0x7faef2b03eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

SUMMARY: AddressSanitizer: heap-use-after-free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594 event_process_active_single_queue
Shadow bytes around the buggy address:
  0x0c187fffeb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fffebd0: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c187fffebe0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffebf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffec00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffec10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffec20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8413==ABORTING
[Lost connection!] 
  [within_cb FAILED]
=================================================================
==8343==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000798829 at pc 0x7faef45f6b00 bp 0x7fffeecdd430 sp 0x7fffeecdd428
READ of size 42 at 0x000000798829 thread T0
    #0 0x7faef45f6aff in evbuffer_add /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
    #1 0x58813d in test_evbuffer_add_reference /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_buffer.c:1663
    #2 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #3 0x74fad1 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:252
    #4 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #5 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #6 0x7faef2b03eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #7 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x000000798829 is located 55 bytes to the left of global variable '.str258' from 'test/regress_buffer.c' (0x798860) of size 30
  '.str258' is ascii string 'ref_done_cb_called_count == 3'
0x000000798829 is located 6 bytes to the right of global variable '.str257' from 'test/regress_buffer.c' (0x798800) of size 35
  '.str257' is ascii string '. Nothing comes and then a lot'll.'
SUMMARY: AddressSanitizer: global-buffer-overflow /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775 evbuffer_add
Shadow bytes around the buggy address:
  0x0000800eb0b0: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
  0x0000800eb0c0: 03 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb0d0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb0e0: f9 f9 f9 f9 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000800eb0f0: 00 00 00 01 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
=>0x0000800eb100: 00 00 00 00 03[f9]f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb110: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
  0x0000800eb120: 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb130: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x0000800eb140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800eb150: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8343==ABORTING
FAILED
DEVPOLL 
Skipping test
POLL 
 test-eof: OKAY
 test-closed: [warn] event_base_new_with_config: no event mechanism available
OKAY
 test-weof: OKAY
 test-time: OKAY
 test-changelist: OKAY
 test-fdleak: OKAY
 test-dumpevents: OKAY
 regress: =================================================================
==8622==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000035ed3 at pc 0x7f24889e3a4d bp 0x7fff5d51d810 sp 0x7fff5d51d808
READ of size 1 at 0x60c000035ed3 thread T0
    #0 0x7f24889e3a4c in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
    #1 0x7f24889ad772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #2 0x7f24889a4f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #3 0x7f24889a37ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #4 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #5 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #6 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #7 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #8 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #9 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #10 0x7f2486e00eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #11 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x60c000035ed3 is located 19 bytes inside of 128-byte region [0x60c000035ec0,0x60c000035f40)
freed by thread T0 here:
    #0 0x47b0e9 in __interceptor_free /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7f2488985dab in event_mm_free_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3441
    #2 0x7f24889b74ce in event_free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2110
    #3 0x64b94b in event_finalize_callback_2 /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:241
    #4 0x7f24889e37a8 in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1592
    #5 0x7f24889ad772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #6 0x7f24889a4f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #7 0x7f24889a37ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #8 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #9 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #10 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #11 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #12 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #13 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #14 0x7f2486e00eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

previously allocated by thread T0 here:
    #0 0x47b269 in malloc /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x7f248898591e in event_mm_malloc_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3366
    #2 0x7f24889b6d48 in event_new /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2089
    #3 0x6492b5 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:262
    #4 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #5 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #6 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #7 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #8 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #9 0x7f2486e00eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

SUMMARY: AddressSanitizer: heap-use-after-free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594 event_process_active_single_queue
Shadow bytes around the buggy address:
  0x0c187fffeb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fffebd0: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c187fffebe0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffebf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffec00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffec10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffec20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8622==ABORTING
[Lost connection!] 
  [within_cb FAILED]
=================================================================
==8552==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000798829 at pc 0x7f24888f3b00 bp 0x7fff5d51cef0 sp 0x7fff5d51cee8
READ of size 42 at 0x000000798829 thread T0
    #0 0x7f24888f3aff in evbuffer_add /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
    #1 0x58813d in test_evbuffer_add_reference /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_buffer.c:1663
    #2 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #3 0x74fad1 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:252
    #4 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #5 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #6 0x7f2486e00eac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #7 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x000000798829 is located 55 bytes to the left of global variable '.str258' from 'test/regress_buffer.c' (0x798860) of size 30
  '.str258' is ascii string 'ref_done_cb_called_count == 3'
0x000000798829 is located 6 bytes to the right of global variable '.str257' from 'test/regress_buffer.c' (0x798800) of size 35
  '.str257' is ascii string '. Nothing comes and then a lot'll.'
SUMMARY: AddressSanitizer: global-buffer-overflow /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775 evbuffer_add
Shadow bytes around the buggy address:
  0x0000800eb0b0: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
  0x0000800eb0c0: 03 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb0d0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb0e0: f9 f9 f9 f9 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000800eb0f0: 00 00 00 01 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
=>0x0000800eb100: 00 00 00 00 03[f9]f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb110: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
  0x0000800eb120: 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb130: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x0000800eb140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800eb150: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8552==ABORTING
FAILED
SELECT 
 test-eof: OKAY
 test-closed: [warn] event_base_new_with_config: no event mechanism available
OKAY
 test-weof: OKAY
 test-time: OKAY
 test-changelist: OKAY
 test-fdleak: OKAY
 test-dumpevents: OKAY
 regress: =================================================================
==8816==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000035ed3 at pc 0x7f2221d81a4d bp 0x7fff68c1bd30 sp 0x7fff68c1bd28
READ of size 1 at 0x60c000035ed3 thread T0
    #0 0x7f2221d81a4c in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594
    #1 0x7f2221d4b772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #2 0x7f2221d42f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #3 0x7f2221d417ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #4 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #5 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #6 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #7 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #8 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #9 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #10 0x7f222019eeac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #11 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x60c000035ed3 is located 19 bytes inside of 128-byte region [0x60c000035ec0,0x60c000035f40)
freed by thread T0 here:
    #0 0x47b0e9 in __interceptor_free /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7f2221d23dab in event_mm_free_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3441
    #2 0x7f2221d554ce in event_free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2110
    #3 0x64b94b in event_finalize_callback_2 /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:241
    #4 0x7f2221d817a8 in event_process_active_single_queue /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1592
    #5 0x7f2221d4b772 in event_process_active /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1666
    #6 0x7f2221d42f5e in event_base_loop /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1889
    #7 0x7f2221d417ba in event_base_dispatch /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1700
    #8 0x6494d1 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:271
    #9 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #10 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #11 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #12 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #13 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #14 0x7f222019eeac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

previously allocated by thread T0 here:
    #0 0x47b269 in malloc /home/jwalton/Desktop/clang-3.4/llvm-3.4/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x7f2221d2391e in event_mm_malloc_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:3366
    #2 0x7f2221d54d48 in event_new /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:2089
    #3 0x6492b5 in test_fin_within_cb /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_finalize.c:262
    #4 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #5 0x750487 in testcase_run_forked_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:189
    #6 0x74fa36 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:247
    #7 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #8 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #9 0x7f222019eeac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244

SUMMARY: AddressSanitizer: heap-use-after-free /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/event.c:1594 event_process_active_single_queue
Shadow bytes around the buggy address:
  0x0c187fffeb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffeba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffebc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fffebd0: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c187fffebe0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffebf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fffec00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c187fffec10: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffec20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8816==ABORTING
[Lost connection!] 
  [within_cb FAILED]
=================================================================
==8746==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000798829 at pc 0x7f2221c91b00 bp 0x7fff68c1b410 sp 0x7fff68c1b408
READ of size 42 at 0x000000798829 thread T0
    #0 0x7f2221c91aff in evbuffer_add /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775
    #1 0x58813d in test_evbuffer_add_reference /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_buffer.c:1663
    #2 0x751250 in testcase_run_bare_ /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:105
    #3 0x74fad1 in testcase_run_one /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:252
    #4 0x75420b in tinytest_main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/tinytest.c:434
    #5 0x6dbaf1 in main /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/regress_main.c:455
    #6 0x7f222019eeac in __libc_start_main /home/aurel32/eglibc/eglibc-2.13/csu/libc-start.c:244
    #7 0x49133c in _start (/home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/test/.libs/lt-regress+0x49133c)

0x000000798829 is located 55 bytes to the left of global variable '.str258' from 'test/regress_buffer.c' (0x798860) of size 30
  '.str258' is ascii string 'ref_done_cb_called_count == 3'
0x000000798829 is located 6 bytes to the right of global variable '.str257' from 'test/regress_buffer.c' (0x798800) of size 35
  '.str257' is ascii string '. Nothing comes and then a lot'll.'
SUMMARY: AddressSanitizer: global-buffer-overflow /home/jwalton/Desktop/libevent-2.1.4-alpha-candidate/buffer.c:1775 evbuffer_add
Shadow bytes around the buggy address:
  0x0000800eb0b0: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
  0x0000800eb0c0: 03 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb0d0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb0e0: f9 f9 f9 f9 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000800eb0f0: 00 00 00 01 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9
=>0x0000800eb100: 00 00 00 00 03[f9]f9 f9 f9 f9 f9 f9 00 00 00 06
  0x0000800eb110: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
  0x0000800eb120: 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
  0x0000800eb130: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x0000800eb140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800eb150: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8746==ABORTING
FAILED
WIN32 
Skipping test
$

References:
- [Libevent-users] upcoming 2.1.4-alpha Libevent release
  - From: Nick Mathewson

Prev by Author: Re: [Libevent-users] upcoming 2.1.4-alpha Libevent release
Next by Author: Re: [Libevent-users] upcoming 2.1.4-alpha Libevent release
Previous by thread: Re: [Libevent-users] upcoming 2.1.4-alpha Libevent release
Next by thread: Re: [Libevent-users] upcoming 2.1.4-alpha Libevent release
Index(es):
- Author
- Thread