Use after free in fastcgi session code

[ssandler]

Describe the bug
I ran an asan build of hhvm and caught this use-after-free issue in fastcgi mode. It took about a half hour and many thousands of requests before this was hit.

The asan error is big, so I put it in a gist here: https://gist.github.com/ssandler/3597e4bd8accb7c3e8b97f2f00fd6584

But here's a snippet:

==6==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250001208a1 at pc 0x0000025376ba bp 0x7fe0a660b710 sp 0x7fe0a660b708
READ of size 2 at 0x6250001208a1 thread T7
    #0 0x25376b9 in HPHP::FastCGISession::readDataAvailable(unsigned long) (/usr/bin/hhvm+0x25376b9)
    #1 0x7343327 in folly::AsyncSocket::handleRead() (/usr/bin/hhvm+0x7343327)
    #2 0x733f500 in folly::AsyncSocket::ioReady(unsigned short) (/usr/bin/hhvm+0x733f500)
    #3 0x7fe2c7a4c8f7  (/usr/lib/x86_64-linux-gnu/libevent-2.1.so.6+0x1e8f7)
    #4 0x7fe2c7a4d33e in event_base_loop (/usr/lib/x86_64-linux-gnu/libevent-2.1.so.6+0x1f33e)
    #5 0x7363804 in folly::EventBase::loopBody(int, bool) (/usr/bin/hhvm+0x7363804)
    #6 0x7365a93 in folly::EventBase::loopForever() (/usr/bin/hhvm+0x7365a93)
    #7 0x8248be6 in proxygen::WorkerThread::runLoop() (/usr/bin/hhvm+0x8248be6)
    #8 0x8249052  (/usr/bin/hhvm+0x8249052)
    #9 0x7fe2c0c9a6de  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de)
    #10 0x7fe2c6d436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #11 0x7fe2c035771e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x6250001208a1 is located 4001 bytes inside of 8032-byte region [0x62500011f900,0x625000121860)
freed by thread T7 here:
    #0 0xfb94fd in free (/usr/bin/hhvm+0xfb94fd)
    #1 0x72d1992 in folly::IOBuf::freeExtBuffer() (/usr/bin/hhvm+0x72d1992)
    #2 0x72d1551 in folly::IOBuf::coalesceAndReallocate(unsigned long, unsigned long, folly::IOBuf*, unsigned long) (/usr/bin/hhvm+0x72d1551)
    #3 0x72d1272 in folly::IOBuf::coalesceSlow(unsigned long) (/usr/bin/hhvm+0x72d1272)
    #4 0x2536e97 in HPHP::FastCGISession::readDataAvailable(unsigned long) (/usr/bin/hhvm+0x2536e97)
    #5 0x7343327 in folly::AsyncSocket::handleRead() (/usr/bin/hhvm+0x7343327)
    #6 0x733f500 in folly::AsyncSocket::ioReady(unsigned short) (/usr/bin/hhvm+0x733f500)
    #7 0x7fe2c7a4c8f7  (/usr/lib/x86_64-linux-gnu/libevent-2.1.so.6+0x1e8f7)

Also this may be useful:

addr2line -e /usr/bin/hhvm 0x25376b9 0x2536e97 0x2536db4
/build/hhvm/hphp/runtime/server/fastcgi/fastcgi-protocol.h:32
/build/hhvm/third-party/folly/src/folly/io/IOBuf.h:1205
/build/hhvm/third-party/folly/src/folly/io/IOBuf.h:1205

Environment

• Operating system
  Ubuntu 18.04'
• Installation method
  built from source with -fsanitize=address
• HHVM Version

Please include the output of hhvm --version and hh_client --version

HipHop VM 4.80.6 (rel)
Compiler: remotes/origin/4.80.6-slack-0-g0d1cc2f708e29ce3bffe6bd33ca27ad87d908d04
Repo schema: 368419f649dc5856326d84e9ed95fdef2fbad95f