Use-after-free in Counter.update via re-entrant __add__ #143004
Description
What happened?
A custom __add__ can clear the Counter while _collections__count_elements holds a pointer to the cached count, so PyNumber_Add dereferences the freed object and triggers a use-after-free during the fast dict path.
Proof of Concept:
from collections import Counter
class Evil(int):
def __new__(cls):
return int.__new__(cls, 0)
def __add__(self, other):
# Re-entrant mutation: wipe out the mapping while PyNumber_Add still has
# a live reference to this Evil instance.
global cnt
cnt.clear()
return NotImplemented
def __radd__(self, other):
return 0
cnt = Counter()
key = object()
cnt[key] = Evil()
cnt.update([key])Affected Versions:
Details
| Python Version | Status | Exit Code |
|---|---|---|
Python 3.9.24+ (heads/3.9:111bbc15b26, Oct 27 2025, 21:34:13) |
ASAN | 1 |
Python 3.10.19+ (heads/3.10:014261980b1, Oct 27 2025, 21:19:00) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.11.14+ (heads/3.11:88f3f5b5f11, Oct 27 2025, 21:20:35) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.12.12+ (heads/3.12:8cb2092bd8c, Oct 27 2025, 21:27:07) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.13.9+ (heads/3.13:9c8eade20c6, Oct 27 2025, 21:28:49) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.14.0+ (heads/3.14:2e216728038, Oct 27 2025, 21:30:55) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.15.0a1+ (heads/main:f5394c257ce, Oct 27 2025, 21:32:37) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Vulnerable Code:
Details
static PyObject *
_collections__count_elements_impl(PyObject *module, PyObject *mapping,
PyObject *iterable)
/*[clinic end generated code: output=7e0c1789636b3d8f input=e79fad04534a0b45]*/
{
PyObject *it, *oldval;
PyObject *newval = NULL;
PyObject *key = NULL;
PyObject *bound_get = NULL;
PyObject *mapping_get;
PyObject *dict_get;
PyObject *mapping_setitem;
PyObject *dict_setitem;
PyObject *one = _PyLong_GetOne(); // borrowed reference
/* ... */
if (mapping_get != NULL && mapping_get == dict_get &&
mapping_setitem != NULL && mapping_setitem == dict_setitem &&
PyDict_Check(mapping))
{
while (1) {
/* Fast path advantages:
1. Eliminate double hashing
(by re-using the same hash for both the get and set)
2. Avoid argument overhead of PyObject_CallFunctionObjArgs
(argument tuple creation and parsing)
3. Avoid indirection through a bound method object
(creates another argument tuple)
4. Avoid initial increment from zero
(reuse an existing one-object instead)
*/
Py_hash_t hash;
key = PyIter_Next(it);
if (key == NULL)
break;
hash = _PyObject_HashFast(key);
if (hash == -1) {
goto done;
}
/* Get a borrowed ptr: oldval */
oldval = _PyDict_GetItem_KnownHash(mapping, key, hash);
if (oldval == NULL) {
if (PyErr_Occurred())
goto done;
if (_PyDict_SetItem_KnownHash(mapping, key, one, hash) < 0)
goto done;
} else {
newval = PyNumber_Add(oldval, one);
if (newval == NULL)
goto done;
if (_PyDict_SetItem_KnownHash(mapping, key, newval, hash) < 0)
goto done;
Py_CLEAR(newval);
}
Py_DECREF(key);
}
}
/* ... */Sanitizer Output:
Details
=================================================================
==1346475==ERROR: AddressSanitizer: heap-use-after-free on address 0x5060000f2988 at pc 0x5d9d2b2debac bp 0x7ffc822fd970 sp 0x7ffc822fd968
READ of size 8 at 0x5060000f2988 thread T0
#0 0x5d9d2b2debab in _Py_TYPE /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:277:20
#1 0x5d9d2b2debab in slot_nb_add /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:10401:1
#2 0x5d9d2b12cffb in binary_op1 /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/abstract.c:966:13
#3 0x5d9d2b12ccf3 in PyNumber_Add /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/abstract.c:1132:24
#4 0x5d9d2b66e7ff in _collections__count_elements_impl /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Modules/_collectionsmodule.c:2580:26
#5 0x5d9d2b66e7ff in _collections__count_elements /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Modules/clinic/_collectionsmodule.c.h:593:20
#6 0x5d9d2b16aa3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#7 0x5d9d2b16aa3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12
#8 0x5d9d2b451837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35
#9 0x5d9d2b4323bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#10 0x5d9d2b4323bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#11 0x5d9d2b4323bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21
#12 0x5d9d2b589370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12
#13 0x5d9d2b589370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19
#14 0x5d9d2b58343c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15
#15 0x5d9d2b58343c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13
#16 0x5d9d2b582b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15
#17 0x5d9d2b5eafe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15
#18 0x5d9d2b5eafe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15
#19 0x5d9d2b5e999d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21
#20 0x5d9d2b5e999d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5
#21 0x5d9d2b5ea451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12
#22 0x5d9d2b5ea5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12
#23 0x71acc2c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#24 0x71acc2c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#25 0x5d9d2af9a104 in _start (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x1c7104) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
0x5060000f2988 is located 40 bytes inside of 64-byte region [0x5060000f2960,0x5060000f29a0)
freed by thread T0 here:
#0 0x5d9d2b034cba in free (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x261cba) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
#1 0x5d9d2b2b408b in subtype_dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:2853:5
#2 0x5d9d2b256ce1 in _Py_Dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:3200:5
#3 0x5d9d2b4e8e45 in Py_DECREF_MORTAL /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_object.h:482:9
#4 0x5d9d2b4e8e45 in PyStackRef_XCLOSE /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_stackref.h:827:9
#5 0x5d9d2b4e8e45 in _PyFrame_ClearLocals /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/frame.c:101:9
#6 0x5d9d2b4e8e45 in _PyFrame_ClearExceptCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/frame.c:126:5
#7 0x5d9d2b4651a9 in clear_thread_frame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:1830:5
#8 0x5d9d2b4651a9 in _PyEval_FrameClearAndPop /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:1854:9
#9 0x5d9d2b44acf3 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:10403:13
#10 0x5d9d2b432a14 in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#11 0x5d9d2b432a14 in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#12 0x5d9d2b2e77e2 in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#13 0x5d9d2b2e77e2 in vectorcall_unbound /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3034:12
#14 0x5d9d2b2e77e2 in vectorcall_maybe /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3131:24
#15 0x5d9d2b2de8b4 in slot_nb_add /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:10401:1
#16 0x5d9d2b12cffb in binary_op1 /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/abstract.c:966:13
#17 0x5d9d2b12ccf3 in PyNumber_Add /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/abstract.c:1132:24
#18 0x5d9d2b66e7ff in _collections__count_elements_impl /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Modules/_collectionsmodule.c:2580:26
#19 0x5d9d2b66e7ff in _collections__count_elements /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Modules/clinic/_collectionsmodule.c.h:593:20
#20 0x5d9d2b16aa3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#21 0x5d9d2b16aa3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12
#22 0x5d9d2b451837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35
#23 0x5d9d2b4323bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#24 0x5d9d2b4323bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#25 0x5d9d2b4323bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21
#26 0x5d9d2b589370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12
#27 0x5d9d2b589370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19
#28 0x5d9d2b58343c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15
#29 0x5d9d2b58343c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13
#30 0x5d9d2b582b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15
#31 0x5d9d2b5eafe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15
#32 0x5d9d2b5eafe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15
#33 0x5d9d2b5e999d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21
#34 0x5d9d2b5e999d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5
#35 0x5d9d2b5ea451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12
#36 0x5d9d2b5ea5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12
#37 0x71acc2c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#38 0x71acc2c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#39 0x5d9d2af9a104 in _start (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x1c7104) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
previously allocated by thread T0 here:
#0 0x5d9d2b034f53 in malloc (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x261f53) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
#1 0x5d9d2b2af2f4 in _PyObject_MallocWithType /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_object_alloc.h:46:17
#2 0x5d9d2b2af2f4 in _PyType_AllocNoTrack /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:2505:19
#3 0x5d9d2b2aef8d in PyType_GenericAlloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:2536:21
#4 0x5d9d2b208ff8 in long_subtype_new /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/longobject.c:6048:30
#5 0x5d9d2b208ff8 in long_new_impl /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/longobject.c:5987:16
#6 0x5d9d2b1f9c85 in long_new /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/clinic/longobject.c.h:69:20
#7 0x5d9d2b2cbab7 in tp_new_wrapper /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:10148:11
#8 0x5d9d2b243c44 in cfunction_call /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/methodobject.c:564:18
#9 0x5d9d2b1697b2 in _PyObject_MakeTpCall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:242:18
#10 0x5d9d2b451837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35
#11 0x5d9d2b432a14 in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#12 0x5d9d2b432a14 in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#13 0x5d9d2b1693ca in _PyObject_VectorcallDictTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:135:15
#14 0x5d9d2b16b52a in _PyObject_Call_Prepend /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:504:24
#15 0x5d9d2b2cbcdd in slot_tp_new /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:10860:14
#16 0x5d9d2b2b8a9b in type_call /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:2449:11
#17 0x5d9d2b1697b2 in _PyObject_MakeTpCall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:242:18
#18 0x5d9d2b451837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35
#19 0x5d9d2b4323bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#20 0x5d9d2b4323bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#21 0x5d9d2b4323bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21
#22 0x5d9d2b589370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12
#23 0x5d9d2b589370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19
#24 0x5d9d2b58343c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15
#25 0x5d9d2b58343c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13
#26 0x5d9d2b582b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15
#27 0x5d9d2b5eafe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15
#28 0x5d9d2b5eafe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15
#29 0x5d9d2b5e999d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21
#30 0x5d9d2b5e999d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5
#31 0x5d9d2b5ea451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12
#32 0x5d9d2b5ea5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12
#33 0x71acc2c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#34 0x71acc2c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#35 0x5d9d2af9a104 in _start (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x1c7104) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
SUMMARY: AddressSanitizer: heap-use-after-free /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:277:20 in _Py_TYPE
Shadow bytes around the buggy address:
0x5060000f2700: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
0x5060000f2780: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd
0x5060000f2800: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00
0x5060000f2880: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x5060000f2900: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
=>0x5060000f2980: fd[fd]fd fd fa fa fa fa 00 00 00 00 00 00 00 00
0x5060000f2a00: fa fa fa fa 00 00 00 00 00 00 07 fa fa fa fa fa
0x5060000f2a80: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
0x5060000f2b00: 00 00 07 fa fa fa fa fa 00 00 00 00 00 00 00 00
0x5060000f2b80: fa fa fa fa 00 00 00 00 00 00 07 fa fa fa fa fa
0x5060000f2c00: 00 00 00 00 00 00 07 fa fa fa fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1346475==ABORTING