radare2 leaks when using tabs in visual panels mode

[pawlos]

Work environment

Questions	Answers
OS/arch/bits (mandatory)	Ubuntu 18.04 64bit (WSL)
File format of the file you reverse (mandatory)	ELF
Architecture/bits of the file (mandatory)	x86/64
r2 -v full output, not truncated (mandatory)	rradare2 4.5.0-git 24831 @ linux-x86-64 git.4.4.0-115-g153de5617 commit: 153de56 build: 2020-05-03__12:04:10

Expected behavior

r2 doesn't leak memory

Actual behavior

r2 leaks

Steps to reproduce the behavior

• start radare2: r2 /bin/ls
• go to Visual panels mode: V!
• add new tab: t and then again t
• quit from r2: qx3,

SUMMARY: AddressSanitizer: 344905 byte(s) leaked in 5692 allocation(s).

Additional Logs, screenshots, source-code, configuration dump, ...

https://gist.github.com/pawlos/5924100db827d3499a46a4967b0ca36d

[radare]

Can you paste the output of asan?

…

On 3 May 2020, at 09:30, Paweł Łukasik ***@***.***> wrote:  Work environment Questions Answers OS/arch/bits (mandatory) Ubuntu 18.04 64bit (WSL) File format of the file you reverse (mandatory) ELF Architecture/bits of the file (mandatory) x86/64 r2 -v full output, not truncated (mandatory) radare2 4.0.0 24826 @ linux-x86-64 git.4.0.0 commit: e970472 build: 2020-05-03__08:32:53 Expected behavior r2 exits V! mode without issue Actual behavior r2 crashes Steps to reproduce the behavior start radare2: r2 /bin/ls go to Visual panels mode: V! add new tab: t and then again t quit visual panels mode: q free(): invalid size Aborted (core dumped) Additional Logs, screenshots, source-code, configuration dump, ... #0 __GI_raise ***@***.***=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f7bb866a801 in __GI_abort () at abort.c:79 #2 0x00007f7bb86b3897 in __libc_message ***@***.***=do_abort, ***@***.***=0x7f7bb87e0b9a "%s\n") at ../sysdeps/posix/libc_fatal.c:181 #3 0x00007f7bb86ba90a in malloc_printerr ***@***.***=0x7f7bb87deda0 "free(): invalid size") at malloc.c:5350 #4 0x00007f7bb86c1e2c in _int_free (have_lock=0, p=0x55972f02e090, av=0x7f7bb8a15c40 <main_arena>) at malloc.c:4161 #5 __GI___libc_free (mem=0x55972f02e0a0) at malloc.c:3124 #6 0x00007f7bb67711a0 in __free_menu_item (item=0x55972f02fe00) at panels.c:4973 #7 0x00007f7bb6772e4d in __mht_free_kv (kv=0x55972f030488) at panels.c:5409 #8 0x00007f7bb8d4e70b in ht_pp_free (ht=0x55972efafbb0) at ht_inc.c:140 #9 0x00007f7bb6774cb0 in __panels_free (panels_root=0x55972efae030, i=0, panels=0x55972efae350) at panels.c:5974 #10 0x00007f7bb67766ba in __del_panels (core=0x7f7bb8c470c0 <r>) at panels.c:6491 #11 0x00007f7bb67764d0 in r_core_visual_panels_root (core=0x7f7bb8c470c0 <r>, panels_root=0x55972efae030) at panels.c:6444 #12 0x00007f7bb66e44d5 in r_core_visual_cmd (core=0x7f7bb8c470c0 <r>, arg=0x55972efadfa1 "!") at visual.c:2569 #13 0x00007f7bb66ea2e7 in r_core_visual (core=0x7f7bb8c470c0 <r>, input=0x55972efadfa1 "!") at visual.c:4201 #14 0x00007f7bb66be459 in cmd_visual (data=0x7f7bb8c470c0 <r>, input=0x55972efadfa1 "!") at cmd.c:1747 #15 0x00007f7bb6719bc7 in r_cmd_call (cmd=0x55972ed646b0, input=0x55972efadfa0 "V!") at cmd_api.c:244 #16 0x00007f7bb66c3c58 in r_core_cmd_subst_i (core=0x7f7bb8c470c0 <r>, cmd=0x55972efadfa0 "V!", colon=0x0, tmpseek=0x7ffcfeae94fa) at cmd.c:3589 #17 0x00007f7bb66bffdc in r_core_cmd_subst (core=0x7f7bb8c470c0 <r>, cmd=0x55972efadfa0 "V!") at cmd.c:2467 #18 0x00007f7bb66c6a6b in r_core_cmd (core=0x7f7bb8c470c0 <r>, cstr=0x55972efadf60 "V!", log=1) at cmd.c:4424 #19 0x00007f7bb6611a38 in r_core_prompt_exec (r=0x7f7bb8c470c0 <r>) at core.c:3102 #20 0x00007f7bb8a39437 in r_main_radare2 (argc=2, argv=0x7ffcfeae99e8) at radare2.c:1463 #21 0x000055972d8d3c60 in main (argc=2, argv=0x7ffcfeae99e8) at radare2.c:95 #22 0x00007f7bb864bb97 in __libc_start_main (main=0x55972d8d3c0c <main>, argc=2, argv=0x7ffcfeae99e8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffcfeae99d8) at ../csu/libc-start.c:310 #23 0x000055972d8d393a in _start () — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[pawlos]

=================================================================
==3434==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400038e598 at pc 0x7f5115dd5501 bp 0x7ffd9e74e030 sp 0x7ffd9e74e020
READ of size 8 at 0x60400038e598 thread T0
#0 0x7f5115dd5500 in __free_menu_item /home/ubuntu/radare2/libr/core/panels.c:4972
#1 0x7f5115ddb305 in __mht_free_kv /home/ubuntu/radare2/libr/core/panels.c:5409
#2 0x7f511d4ffc79 in ht_pp_free /home/ubuntu/radare2/shlr/sdb/src/ht_inc.c:140
#3 0x7f5115de2ed9 in __panels_free /home/ubuntu/radare2/libr/core/panels.c:5974
#4 0x7f5115de9c18 in __del_panels /home/ubuntu/radare2/libr/core/panels.c:6491
#5 0x7f5115de947c in r_core_visual_panels_root /home/ubuntu/radare2/libr/core/panels.c:6444
#6 0x7f5115bd7353 in r_core_visual_cmd /home/ubuntu/radare2/libr/core/visual.c:2569
#7 0x7f5115bed2bd in r_core_visual /home/ubuntu/radare2/libr/core/visual.c:4201
#8 0x7f5115b5ca16 in cmd_visual /home/ubuntu/radare2/libr/core/cmd.c:1747
#9 0x7f5115c8e5da in r_cmd_call /home/ubuntu/radare2/libr/core/cmd_api.c:244
#10 0x7f5115b6db47 in r_core_cmd_subst_i /home/ubuntu/radare2/libr/core/cmd.c:3589
#11 0x7f5115b61f5b in r_core_cmd_subst /home/ubuntu/radare2/libr/core/cmd.c:2467
#12 0x7f5115b7700c in r_core_cmd /home/ubuntu/radare2/libr/core/cmd.c:4424
#13 0x7f511594966a in r_core_prompt_exec /home/ubuntu/radare2/libr/core/core.c:3102
#14 0x7f511ce1afa9 in r_main_radare2 /home/ubuntu/radare2/libr/main/radare2.c:1463
#15 0x55f6ad02d782 in main /home/ubuntu/radare2/binr/radare2/radare2.c:95
#16 0x7f511bcafb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
#17 0x55f6ad02d2c9 in _start (/home/ubuntu/radare2/binr/radare2/radare2+0x12c9)

0x60400038e598 is located 8 bytes inside of 40-byte region [0x60400038e590,0x60400038e5b8)
freed by thread T0 here:
#0 0x7f511dc557a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
#1 0x7f5115dd5852 in __free_menu_item /home/ubuntu/radare2/libr/core/panels.c:4980
#2 0x7f5115dd5763 in __free_menu_item /home/ubuntu/radare2/libr/core/panels.c:4977
#3 0x7f5115ddb305 in __mht_free_kv /home/ubuntu/radare2/libr/core/panels.c:5409
#4 0x7f511d4ffc79 in ht_pp_free /home/ubuntu/radare2/shlr/sdb/src/ht_inc.c:140
#5 0x7f5115de2ed9 in __panels_free /home/ubuntu/radare2/libr/core/panels.c:5974
#6 0x7f5115de9c18 in __del_panels /home/ubuntu/radare2/libr/core/panels.c:6491
#7 0x7f5115de947c in r_core_visual_panels_root /home/ubuntu/radare2/libr/core/panels.c:6444
#8 0x7f5115bd7353 in r_core_visual_cmd /home/ubuntu/radare2/libr/core/visual.c:2569
#9 0x7f5115bed2bd in r_core_visual /home/ubuntu/radare2/libr/core/visual.c:4201
#10 0x7f5115b5ca16 in cmd_visual /home/ubuntu/radare2/libr/core/cmd.c:1747
#11 0x7f5115c8e5da in r_cmd_call /home/ubuntu/radare2/libr/core/cmd_api.c:244
#12 0x7f5115b6db47 in r_core_cmd_subst_i /home/ubuntu/radare2/libr/core/cmd.c:3589
#13 0x7f5115b61f5b in r_core_cmd_subst /home/ubuntu/radare2/libr/core/cmd.c:2467
#14 0x7f5115b7700c in r_core_cmd /home/ubuntu/radare2/libr/core/cmd.c:4424
#15 0x7f511594966a in r_core_prompt_exec /home/ubuntu/radare2/libr/core/core.c:3102
#16 0x7f511ce1afa9 in r_main_radare2 /home/ubuntu/radare2/libr/main/radare2.c:1463
#17 0x55f6ad02d782 in main /home/ubuntu/radare2/binr/radare2/radare2.c:95
#18 0x7f511bcafb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

previously allocated by thread T0 here:
#0 0x7f511dc55d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
#1 0x7f5115dca8aa in __add_menu /home/ubuntu/radare2/libr/core/panels.c:4402
#2 0x7f5115dcd62a in __init_menu_screen_settings_layout /home/ubuntu/radare2/libr/core/panels.c:4604
#3 0x7f5115dd3bf0 in __init_panels_menu /home/ubuntu/radare2/libr/core/panels.c:4849
#4 0x7f5115de97f2 in __init_new_panels_root /home/ubuntu/radare2/libr/core/panels.c:6466
#5 0x7f5115de8cbf in r_core_visual_panels_root /home/ubuntu/radare2/libr/core/panels.c:6411
#6 0x7f5115bd7353 in r_core_visual_cmd /home/ubuntu/radare2/libr/core/visual.c:2569
#7 0x7f5115bed2bd in r_core_visual /home/ubuntu/radare2/libr/core/visual.c:4201
#8 0x7f5115b5ca16 in cmd_visual /home/ubuntu/radare2/libr/core/cmd.c:1747
#9 0x7f5115c8e5da in r_cmd_call /home/ubuntu/radare2/libr/core/cmd_api.c:244
#10 0x7f5115b6db47 in r_core_cmd_subst_i /home/ubuntu/radare2/libr/core/cmd.c:3589
#11 0x7f5115b61f5b in r_core_cmd_subst /home/ubuntu/radare2/libr/core/cmd.c:2467
#12 0x7f5115b7700c in r_core_cmd /home/ubuntu/radare2/libr/core/cmd.c:4424
#13 0x7f511594966a in r_core_prompt_exec /home/ubuntu/radare2/libr/core/core.c:3102
#14 0x7f511ce1afa9 in r_main_radare2 /home/ubuntu/radare2/libr/main/radare2.c:1463
#15 0x55f6ad02d782 in main /home/ubuntu/radare2/binr/radare2/radare2.c:95
#16 0x7f511bcafb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-use-after-free /home/ubuntu/radare2/libr/core/panels.c:4972 in __free_menu_item
Shadow bytes around the buggy address:
0x0c0880069c60: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 05 fa
0x0c0880069c70: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00
0x0c0880069c80: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x0c0880069c90: fa fa 00 00 00 00 05 fa fa fa 00 00 00 00 00 fa
0x0c0880069ca0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 02 fa
=>0x0c0880069cb0: fa fa fd[fd]fd fd fd fa fa fa fd fd fd fd fd fd
0x0c0880069cc0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00
0x0c0880069cd0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00
0x0c0880069ce0: fa fa 00 00 00 00 06 fa fa fa fd fd fd fd fd fa
0x0c0880069cf0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
0x0c0880069d00: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3434==ABORTING

[radare]

uhm are you using r2 4.0? because the lines of the errors dont match what i have in master

…

On 3 May 2020, at 09:45, Pancake Nopcode ***@***.***> wrote: Can you paste the output of asan? > On 3 May 2020, at 09:30, Paweł Łukasik ***@***.***> wrote: > >  > > Work environment > > Questions Answers > OS/arch/bits (mandatory) Ubuntu 18.04 64bit (WSL) > File format of the file you reverse (mandatory) ELF > Architecture/bits of the file (mandatory) x86/64 > r2 -v full output, not truncated (mandatory) radare2 4.0.0 24826 @ linux-x86-64 git.4.0.0 commit: e970472 <e970472> build: 2020-05-03__08:32:53 > Expected behavior > > r2 exits V! mode without issue > > Actual behavior > > r2 crashes > > Steps to reproduce the behavior > > start radare2: r2 /bin/ls > go to Visual panels mode: V! > add new tab: t and then again t > quit visual panels mode: q > free(): invalid size > Aborted (core dumped) > > Additional Logs, screenshots, source-code, configuration dump, ... > > #0 __GI_raise ***@***.***=6) at ../sysdeps/unix/sysv/linux/raise.c:51 > #1 0x00007f7bb866a801 in __GI_abort () at abort.c:79 > #2 0x00007f7bb86b3897 in __libc_message ***@***.***=do_abort, ***@***.***=0x7f7bb87e0b9a "%s\n") at ../sysdeps/posix/libc_fatal.c:181 > #3 0x00007f7bb86ba90a in malloc_printerr ***@***.***=0x7f7bb87deda0 "free(): invalid size") at malloc.c:5350 > #4 0x00007f7bb86c1e2c in _int_free (have_lock=0, p=0x55972f02e090, av=0x7f7bb8a15c40 <main_arena>) at malloc.c:4161 > #5 __GI___libc_free (mem=0x55972f02e0a0) at malloc.c:3124 > #6 0x00007f7bb67711a0 in __free_menu_item (item=0x55972f02fe00) at panels.c:4973 > #7 0x00007f7bb6772e4d in __mht_free_kv (kv=0x55972f030488) at panels.c:5409 > #8 0x00007f7bb8d4e70b in ht_pp_free (ht=0x55972efafbb0) at ht_inc.c:140 > #9 0x00007f7bb6774cb0 in __panels_free (panels_root=0x55972efae030, i=0, panels=0x55972efae350) at panels.c:5974 > #10 0x00007f7bb67766ba in __del_panels (core=0x7f7bb8c470c0 <r>) at panels.c:6491 > #11 0x00007f7bb67764d0 in r_core_visual_panels_root (core=0x7f7bb8c470c0 <r>, panels_root=0x55972efae030) at panels.c:6444 > #12 0x00007f7bb66e44d5 in r_core_visual_cmd (core=0x7f7bb8c470c0 <r>, arg=0x55972efadfa1 "!") at visual.c:2569 > #13 0x00007f7bb66ea2e7 in r_core_visual (core=0x7f7bb8c470c0 <r>, input=0x55972efadfa1 "!") at visual.c:4201 > #14 0x00007f7bb66be459 in cmd_visual (data=0x7f7bb8c470c0 <r>, input=0x55972efadfa1 "!") at cmd.c:1747 > #15 0x00007f7bb6719bc7 in r_cmd_call (cmd=0x55972ed646b0, input=0x55972efadfa0 "V!") at cmd_api.c:244 > #16 0x00007f7bb66c3c58 in r_core_cmd_subst_i (core=0x7f7bb8c470c0 <r>, cmd=0x55972efadfa0 "V!", colon=0x0, tmpseek=0x7ffcfeae94fa) at cmd.c:3589 > #17 0x00007f7bb66bffdc in r_core_cmd_subst (core=0x7f7bb8c470c0 <r>, cmd=0x55972efadfa0 "V!") at cmd.c:2467 > #18 0x00007f7bb66c6a6b in r_core_cmd (core=0x7f7bb8c470c0 <r>, cstr=0x55972efadf60 "V!", log=1) at cmd.c:4424 > #19 0x00007f7bb6611a38 in r_core_prompt_exec (r=0x7f7bb8c470c0 <r>) at core.c:3102 > #20 0x00007f7bb8a39437 in r_main_radare2 (argc=2, argv=0x7ffcfeae99e8) at radare2.c:1463 > #21 0x000055972d8d3c60 in main (argc=2, argv=0x7ffcfeae99e8) at radare2.c:95 > #22 0x00007f7bb864bb97 in __libc_start_main (main=0x55972d8d3c0c <main>, argc=2, argv=0x7ffcfeae99e8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffcfeae99d8) at ../csu/libc-start.c:310 > #23 0x000055972d8d393a in _start () > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub <#16757>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAG75FXV6FBH5DHBRM25UETRPUMSVANCNFSM4MYAMBTQ>. >

[pawlos]

@radare yes, building with ./sys/install.sh but let me rebuild again.

I've noticed that something is in fact not right. Rebuilding my setup and will post an update.

[pawlos]

@radare sorry, it was a mistake on my side not using the latests. The latest doesn't crash in that exact spot but building with the ./sys/sanitizer.sh and doing the same steps I'm getting a lot of output from it (~ 2MB file).

...
SUMMARY: AddressSanitizer: 554163 byte(s) leaked in 9663 allocation(s).

Should I post that output instead?

[radare]

in line:

#0 0x7f5115dd5500 in __free_menu_item /home/ubuntu/radare2/libr/core/panels.c:4972

i have this:

demo_end:                         r_cons_clear00 ();

your backtrace doesnt looks in sync with git, and i cant reproduce the crash you posted

[pawlos]

@radare check my previous comment. I've re-did and the crash does not occur but asan produce a lot of other messages about leaked bytes.

[radare]

Can you update the issue title and description ? It’s a memleak instead of a crash, right?

[pawlos]

@radare updated