Вот простое, воспроизводимое приложение для тестирования: < /p>
Код: Выделить всё
#define WIN32_LEAN_AND_MEAN
#include
#include
#include
#include
int* test;
int CreateThreads(__int64);
unsigned __stdcall CreateThreads2(void *data) {
auto depth = (__int64)data;
depth--;
if (depth 1) {
depth = atoi(argv[1]);
}
printf("depth: %d\n", depth);
test = new int[15];
delete[] test;
CreateThreads(depth);
return 0;
}
Выше было скомпилировано с Cl /fsanitize = address /o2 /zi test.cpp < /code>. После компиляции я установил переменную среды, чтобы иметь сгенерированные файлы дампы ASAN путем запуска SET SET ASAN_SAVE_DUMPS = TEST .
Когда результирующее приложение запускается с помощью test.exe 6 Следующий вывод присутствует в окне отладки визуальной студии при отладке результирующего файла дампа:
Код: Выделить всё
==18524==ERROR: AddressSanitizer: heap-use-after-free on address 0x123e2eaa0634 at pc 0x7ff63ab81097 bp 0x0055455ffb10 sp 0x0055455ffb18
READ of size 4 at 0x123e2eaa0634 thread T6
#0 0x7ff63ab81096 in CreateThreads2(void *) H:\Projects\cpptest\test.cpp:16
#1 0x7ff63ab94f71 in thread_start minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:97
#2 0x7ffc6df0c96d in asan_thread_start D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:170
#3 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#4 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
0x123e2eaa0634 is located 20 bytes inside of 60-byte region [0x123e2eaa0620,0x123e2eaa065c)
freed by thread T0 here:
#0 0x7ff63ab82afe in operator delete[](void *) D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win_delete_array_thunk.cpp:43
#1 0x7ff63ab81204 in main H:\Projects\cpptest\test.cpp:39
#2 0x7ff63ab83047 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#3 0x7ff63ab83047 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#4 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#5 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
previously allocated by thread T0 here:
#0 0x7ff63ab82a3e in operator new[](unsigned __int64) D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win_new_array_thunk.cpp:41
#1 0x7ff63ab811f5 in main H:\Projects\cpptest\test.cpp:38
#2 0x7ff63ab83047 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#3 0x7ff63ab83047 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#4 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#5 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
Thread T6 created by T5 here:
#0 0x7ffc6df0cd77 in CreateThread D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:223
#1 0x7ff63ab95336 in _beginthreadex minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:209
#2 0x7ff63ab810d1 in CreateThreads(__int64) H:\Projects\cpptest\test.cpp:23
#3 0x7ff63ab810a7 in CreateThreads2(void *) H:\Projects\cpptest\test.cpp:19
#4 0x7ff63ab94f71 in thread_start minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:97
#5 0x7ffc6df0c96d in asan_thread_start D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:170
#6 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#7 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
Thread T5 created by T4 here:
#0 0x7ffc6df0cd77 in CreateThread D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:223
#1 0x7ff63ab95336 in _beginthreadex minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:209
#2 0x7ff63ab810d1 in CreateThreads(__int64) H:\Projects\cpptest\test.cpp:23
#3 0x7ff63ab810a7 in CreateThreads2(void *) H:\Projects\cpptest\test.cpp:19
#4 0x7ff63ab94f71 in thread_start minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:97
#5 0x7ffc6df0c96d in asan_thread_start D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:170
#6 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#7 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
Thread T4 created by T3 here:
#0 0x7ffc6df0cd77 in CreateThread D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:223
#1 0x7ff63ab95336 in _beginthreadex minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:209
#2 0x7ff63ab810d1 in CreateThreads(__int64) H:\Projects\cpptest\test.cpp:23
#3 0x7ff63ab810a7 in CreateThreads2(void *) H:\Projects\cpptest\test.cpp:19
#4 0x7ff63ab94f71 in thread_start minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:97
#5 0x7ffc6df0c96d in asan_thread_start D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:170
#6 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#7 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
Thread T3 created by T2 here:
#0 0x7ffc6df0cd77 in CreateThread D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:223
#1 0x7ff63ab95336 in _beginthreadex minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:209
#2 0x7ff63ab810d1 in CreateThreads(__int64) H:\Projects\cpptest\test.cpp:23
#3 0x7ff63ab810a7 in CreateThreads2(void *) H:\Projects\cpptest\test.cpp:19
#4 0x7ff63ab94f71 in thread_start minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:97
#5 0x7ffc6df0c96d in asan_thread_start D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:170
#6 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#7 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
Thread T2 created by T1 here:
#0 0x7ffc6df0cd77 in CreateThread D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:223
#1 0x7ff63ab95336 in _beginthreadex minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:209
#2 0x7ff63ab810d1 in CreateThreads(__int64) H:\Projects\cpptest\test.cpp:23
#3 0x7ff63ab810a7 in CreateThreads2(void *) H:\Projects\cpptest\test.cpp:19
#4 0x7ff63ab94f71 in thread_start minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:97
#5 0x7ffc6df0c96d in asan_thread_start D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:170
#6 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#7 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
Thread T1 created by T0 here:
#0 0x7ffc6df0cd77 in CreateThread D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:223
#1 0x7ff63ab95336 in _beginthreadex minkernel\crts\ucrt\src\appcrt\startup\thread.cpp:209
#2 0x7ff63ab81222 in main H:\Projects\cpptest\test.cpp:41
#3 0x7ff63ab83047 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#4 0x7ff63ab83047 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#5 0x7ffd2664259c (C:\WINDOWS\System32\KERNEL32.DLL+0x18001259c)
#6 0x7ffd2800af37 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005af37)
SUMMARY: AddressSanitizer: heap-use-after-free H:\Projects\cpptest\test.cpp:16 in CreateThreads2(void *)
Shadow bytes around the buggy address:
0x123e2eaa0380: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00
0x123e2eaa0400: 00 00 00 02 fa fa fa fa 00 00 00 00 00 00 00 02
0x123e2eaa0480: fa fa fa fa 00 00 00 00 00 00 07 fa fa fa fa fa
0x123e2eaa0500: 00 00 00 00 00 00 00 06 fa fa fa fa 00 00 00 00
0x123e2eaa0580: 00 00 06 fa fa fa fa fa 00 00 00 00 00 00 05 fa
=>0x123e2eaa0600: fa fa fa fa fd fd[fd]fd fd fd fd fd fa fa fa fa
0x123e2eaa0680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x123e2eaa0700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x123e2eaa0780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x123e2eaa0800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x123e2eaa0880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Address Sanitizer Error: Use of deallocated memory
Full error details can be found in the Debug Output window
Код: Выделить всё
Address Sanitizer Error: Use of deallocated memory
Подробнее здесь: https://stackoverflow.com/questions/796 ... on-tracing
Мобильная версия