Native support for 64bit builds #45

Open
digulla opened this Issue Dec 18, 2012 · 12 comments

Projects

None yet

5 participants

@digulla
digulla commented Dec 18, 2012

It would be nice if r3 supported 64bit platforms natively.

Currently, you have to install a 32bit compatibility layer to build and run REBOL on 64 bit platforms.

@earl
Contributor
earl commented Dec 18, 2012

Thanks for your report. This is also tracked by the following CureCode issue: http://issue.cc/r3/1785

@carls
Contributor
carls commented Dec 25, 2012

What happens when you try building with -m64? Of course, in src/core/b-init.c, disable the sizeof asserts.

@chneukirchen

I tried this with the first public version, and it instantly crashed, after disabling the sizeofs:

juno r3@master/make% file r3
r3: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=0x03f9e0707fd7d030be70ba1f83521902ae7b3f9c, stripped
juno r3@master/make% ./r3
REBOL System Error:
REBOL System Error #1001: boot failure

Program terminated abnormally.
This should never happen.
Please contact www.REBOL.com with details.

@memfrag
memfrag commented Dec 29, 2012

I've built and run a 64-bit executable successfully, or at least apparently successfully. I had to disable a few asserts, but since I don't yet understand what the asserts are asserting, it may cause other problems. :-) Anyway, I disabled the following asserts:

In core/m-pools.c:

    // Verify that size matches pool size:
    if (pool_num < SERIES_POOL) {
        ASSERT(Mem_Pools[pool_num].wide == size, RP_FREE_NODE_SIZE);
    }

In core/b-init.c:

    ASSERT(VAL_TYPE(&val) == 123,  RP_REBVAL_ALIGNMENT);
    ASSERT(sizeof(REBVAL) == 16,   RP_REBVAL_ALIGNMENT);
    ASSERT1(sizeof(REBDAT) == 4,   RP_BAD_SIZE);
    ASSERT1(sizeof(REBGOB) == 64,  RP_BAD_SIZE);
@earl
Contributor
earl commented Dec 29, 2012

@memfrag Very cool, thanks for chiming in. But I'm wondering: this alone gives you something that runs?

I've got to very similar changes so far, but still get an error when trying to run the binary:

$ ./r3
REBOL System Error:
REBOL System Error #1000: boot failure

Program terminated abnormally.
This should never happen.

This seems to be in the decompression of the boot script. Will try to disable boot script compression next, when I find some time.

@memfrag
memfrag commented Dec 29, 2012

@earl Now that you mention it, I also had to disable:

if (!CHECK_STRUCT_ALIGN) Host_Crash("Incompatible struct alignment");

I noticed that you had disabled this line as well though.

But to answer your question: Yes, this gives me something that runs.

I have made a couple of changes in the Zlib code to get the code to compile at all in Xcode on my Mac, maybe this is the difference, since "System Error #1000: boot failure" (RP_BOOT_DATA) originates from the following code section:

    text = Decompress(&spec, 0, -1, 200000, 0);
    Free_Mem(code, NAT_SPEC_SIZE+1);
    if (!text) Crash(RP_BOOT_DATA);

Like you said, decompression of the boot script must not be working for you.

I am running on Mac OS X 10.8.2 and I am compiling with Clang/LLVM.

@earl
Contributor
earl commented Dec 29, 2012

Could you post a diff of your zlib changes somewhere? Would be quicker to try that than disabling the boot script compression altogether. (FYI: I'm working on Linux with GCC, which did not error out on the zlib code.)

@memfrag
memfrag commented Dec 29, 2012

Sure, I will do that tomorrow though. Have to go to bed right now. :-)

@earl
Contributor
earl commented Dec 29, 2012

No hurries, thanks :)

@memfrag
memfrag commented Dec 29, 2012

The changes I did in u-zlib.c can be achieved by undefining the DEBUG macro, so now I just added -UDEBUG to the C flags for that particular file.

So, all I have done to make Rebol run in 64-bit on OS X was to remove the previously mentioned asserts and then undefining DEBUG for u-zlib.c.

@earl
Contributor
earl commented Dec 29, 2012

Got it working yesterday myself, thanks to your prod towards Clang. On top of the the disabled assertions, I had to do two additional things:

  • Use Clang (3.1) instead of GCC (4.7)
  • Disable compiler optimisations (drop the -O from the makefiles)

Those changes get me working binaries on both Linux and OSX. I didn't do anything re DEBUG. Maybe you do some kind of debug build which resulted in this being defined somehow.

This gets us:

$ file ./r3
r3: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, not stripped

The resulting Linux binary actually works quite well. Two tests from the core-tests test suite crash the interpreter. With those disabled, the result matches Linux 32b builds:

29-Dec-2012/21:42:41+1:00 2.101.0.4.64 Total: 4352 Succeeded: 3957 Test-failures: 53 Crashes: 12 Dialect-failures: 0 Skipped: 330

The OSX binary, on the other hand, segfaults on the test suite (haven't yet investigated further), but at least runs the console and a few scripts I tried (such as src/tools/make-boot.r).

@carls
Contributor
carls commented Dec 31, 2012

Ok, good to hear about this. It is what I expected. R3 runs in 64 bits, with just a few minor sanity checks disabled. (The sanity checks are there to force consistent memory operation over a wide range of platforms.)

It would be fairly easy to add a RUN_DIRTY or NOT_SANE (INSANE) symbol that disables the various checks. There may be a better name, but I don't want to call it anything-64 because this mode is useful for more than just 64 bit operation; it essentially says "I don't care how memory is organized or how efficient the code is, just run it."

In addition, some review of various unions might be worthwhile for 64 bit.

Unfortunately... I don't have a 64bit system here to test with anymore. I took it to the garbage dump many years ago.

@zsx zsx added a commit to zsx/r3 that referenced this issue May 13, 2014
@zsx zsx Do not increase tail before extension
It will confuse Expand_Series expects "tail" to be the actual size, and
cause a read beyond the allocated memory, or heap buffer overflow found
by address sanitizer of GCC:
=================================================================
==10856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00000b201 at pc 0x47df61 bp 0x7fffffff2ca0 sp 0x7fffffff2c98
READ of size 1 at 0x62a00000b201 thread T0
    #0 0x47df60 in Expand_Series ../src/core/m-series.c:145
    #1 0x47e5a7 in Extend_Series ../src/core/m-series.c:187
    #2 0x466e0c in Scan_Quote ../src/core/l-scan.c:462
    #3 0x46a797 in Scan_Token ../src/core/l-scan.c:918
    #4 0x46e263 in Scan_Block ../src/core/l-scan.c:1188
    #5 0x46e722 in Scan_Code ../src/core/l-scan.c:1548
    #6 0x46e886 in Scan_Source ../src/core/l-scan.c:1568
    #7 0x4cb85c in Make_Block_Type ../src/core/t-block.c:306
    #8 0x4cd1b8 in T_Block ../src/core/t-block.c:608
    #9 0x4d042e in T_Datatype ../src/core/t-datatype.c:92
    #10 0x42e080 in Do_Act ../src/core/c-function.c:338
    #11 0x42e7e5 in Do_Action ../src/core/c-function.c:396
    #12 0x413628 in Do_Next ../src/core/c-do.c:884
    #13 0x41309b in Do_Next ../src/core/c-do.c:858
    #14 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #15 0x482dd2 in N_case ../src/core/n-control.c:349
    #16 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #17 0x413628 in Do_Next ../src/core/c-do.c:884
    #18 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #19 0x42e869 in Do_Function ../src/core/c-function.c:415
    #20 0x413628 in Do_Next ../src/core/c-do.c:884
    #21 0x41309b in Do_Next ../src/core/c-do.c:858
    #22 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #23 0x42e869 in Do_Function ../src/core/c-function.c:415
    #24 0x413628 in Do_Next ../src/core/c-do.c:884
    #25 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #26 0x414152 in Do_Next ../src/core/c-do.c:939
    #27 0x48201c in N_all ../src/core/n-control.c:261
    #28 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #29 0x413628 in Do_Next ../src/core/c-do.c:884
    #30 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #31 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #32 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #33 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #34 0x413628 in Do_Next ../src/core/c-do.c:884
    #35 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #36 0x42e869 in Do_Function ../src/core/c-function.c:415
    #37 0x413628 in Do_Next ../src/core/c-do.c:884
    #38 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #39 0x414152 in Do_Next ../src/core/c-do.c:939
    #40 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #41 0x48459c in N_if ../src/core/n-control.c:619
    #42 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #43 0x413628 in Do_Next ../src/core/c-do.c:884
    #44 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #45 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #46 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #47 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #48 0x413628 in Do_Next ../src/core/c-do.c:884
    #49 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #50 0x42e869 in Do_Function ../src/core/c-function.c:415
    #51 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #52 0x4824fb in N_apply ../src/core/n-control.c:295
    #53 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #54 0x413628 in Do_Next ../src/core/c-do.c:884
    #55 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #56 0x414152 in Do_Next ../src/core/c-do.c:939
    #57 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #58 0x485388 in N_unless ../src/core/n-control.c:763
    #59 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #60 0x413628 in Do_Next ../src/core/c-do.c:884
    #61 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #62 0x483eff in N_do ../src/core/n-control.c:523
    #63 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #64 0x413628 in Do_Next ../src/core/c-do.c:884
    #65 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #66 0x414152 in Do_Next ../src/core/c-do.c:939
    #67 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #68 0x48459c in N_if ../src/core/n-control.c:619
    #69 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #70 0x413628 in Do_Next ../src/core/c-do.c:884
    #71 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #72 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #73 0x49314d in N_repeat ../src/core/n-loop.c:631
    #74 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #75 0x413628 in Do_Next ../src/core/c-do.c:884
    #76 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #77 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #78 0x413628 in Do_Next ../src/core/c-do.c:884
    #79 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #80 0x485388 in N_unless ../src/core/n-control.c:763
    #81 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #82 0x413628 in Do_Next ../src/core/c-do.c:884
    #83 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #84 0x42e869 in Do_Function ../src/core/c-function.c:415
    #85 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #86 0x4824fb in N_apply ../src/core/n-control.c:295
    #87 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #88 0x413628 in Do_Next ../src/core/c-do.c:884
    #89 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #90 0x414152 in Do_Next ../src/core/c-do.c:939
    #91 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #92 0x485388 in N_unless ../src/core/n-control.c:763
    #93 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #94 0x413628 in Do_Next ../src/core/c-do.c:884
    #95 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #96 0x483eff in N_do ../src/core/n-control.c:523
    #97 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #98 0x413628 in Do_Next ../src/core/c-do.c:884
    #99 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #100 0x414152 in Do_Next ../src/core/c-do.c:939
    #101 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #102 0x48459c in N_if ../src/core/n-control.c:619
    #103 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #104 0x413628 in Do_Next ../src/core/c-do.c:884
    #105 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #106 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #107 0x49314d in N_repeat ../src/core/n-loop.c:631
    #108 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #109 0x413628 in Do_Next ../src/core/c-do.c:884
    #110 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #111 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #112 0x413628 in Do_Next ../src/core/c-do.c:884
    #113 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #114 0x485388 in N_unless ../src/core/n-control.c:763
    #115 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #116 0x413628 in Do_Next ../src/core/c-do.c:884
    #117 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #118 0x42e869 in Do_Function ../src/core/c-function.c:415
    #119 0x413628 in Do_Next ../src/core/c-do.c:884
    #120 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #121 0x484cf1 in N_switch ../src/core/n-control.c:716
    #122 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #123 0x413628 in Do_Next ../src/core/c-do.c:884
    #124 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #125 0x42e869 in Do_Function ../src/core/c-function.c:415
    #126 0x413628 in Do_Next ../src/core/c-do.c:884
    #127 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #128 0x48459c in N_if ../src/core/n-control.c:619
    #129 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #130 0x413628 in Do_Next ../src/core/c-do.c:884
    #131 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #132 0x42e869 in Do_Function ../src/core/c-function.c:415
    #133 0x413628 in Do_Next ../src/core/c-do.c:884
    #134 0x41309b in Do_Next ../src/core/c-do.c:858
    #135 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #136 0x484280 in N_either ../src/core/n-control.c:595
    #137 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #138 0x413628 in Do_Next ../src/core/c-do.c:884
    #139 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #140 0x42e869 in Do_Function ../src/core/c-function.c:415
    #141 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #142 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #143 0x48d102 in N_wake_up ../src/core/n-io.c:415
    #144 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #145 0x413628 in Do_Next ../src/core/c-do.c:884
    #146 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #147 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #148 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #149 0x492b66 in N_loop ../src/core/n-loop.c:590
    #150 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #151 0x413628 in Do_Next ../src/core/c-do.c:884
    #152 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #153 0x42e869 in Do_Function ../src/core/c-function.c:415
    #154 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #155 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #156 0x42fef7 in Awake_System ../src/core/c-port.c:198
    #157 0x43012a in Wait_Ports ../src/core/c-port.c:231
    #158 0x48cd62 in N_wait ../src/core/n-io.c:374
    #159 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #160 0x413628 in Do_Next ../src/core/c-do.c:884
    #161 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #162 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #163 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #164 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #165 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #166 0x4929a7 in N_forever ../src/core/n-loop.c:527
    #167 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #168 0x413628 in Do_Next ../src/core/c-do.c:884
    #169 0x4152ff in Try_Block ../src/core/c-do.c:1077
    #170 0x48507e in N_try ../src/core/n-control.c:740
    #171 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #172 0x413628 in Do_Next ../src/core/c-do.c:884
    #173 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #174 0x414152 in Do_Next ../src/core/c-do.c:939
    #175 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #176 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #177 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #178 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #179 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #180 0x42e869 in Do_Function ../src/core/c-function.c:415
    #181 0x413628 in Do_Next ../src/core/c-do.c:884
    #182 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #183 0x48459c in N_if ../src/core/n-control.c:619
    #184 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #185 0x413628 in Do_Next ../src/core/c-do.c:884
    #186 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #187 0x42e869 in Do_Function ../src/core/c-function.c:415
    #188 0x413628 in Do_Next ../src/core/c-do.c:884
    #189 0x41309b in Do_Next ../src/core/c-do.c:858
    #190 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #191 0x42e869 in Do_Function ../src/core/c-function.c:415
    #192 0x413628 in Do_Next ../src/core/c-do.c:884
    #193 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #194 0x42e869 in Do_Function ../src/core/c-function.c:415
    #195 0x413628 in Do_Next ../src/core/c-do.c:884
    #196 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #197 0x414152 in Do_Next ../src/core/c-do.c:939
    #198 0x48201c in N_all ../src/core/n-control.c:261
    #199 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #200 0x413628 in Do_Next ../src/core/c-do.c:884
    #201 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #202 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #203 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #204 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #205 0x413628 in Do_Next ../src/core/c-do.c:884
    #206 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #207 0x42e869 in Do_Function ../src/core/c-function.c:415
    #208 0x413628 in Do_Next ../src/core/c-do.c:884
    #209 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #210 0x485388 in N_unless ../src/core/n-control.c:763
    #211 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #212 0x413628 in Do_Next ../src/core/c-do.c:884
    #213 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #214 0x42e869 in Do_Function ../src/core/c-function.c:415
    #215 0x413628 in Do_Next ../src/core/c-do.c:884
    #216 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #217 0x48459c in N_if ../src/core/n-control.c:619
    #218 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #219 0x413628 in Do_Next ../src/core/c-do.c:884
    #220 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #221 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #222 0x413628 in Do_Next ../src/core/c-do.c:884
    #223 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #224 0x414152 in Do_Next ../src/core/c-do.c:939
    #225 0x48201c in N_all ../src/core/n-control.c:261
    #226 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #227 0x413628 in Do_Next ../src/core/c-do.c:884
    #228 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #229 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #230 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #231 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #232 0x413628 in Do_Next ../src/core/c-do.c:884
    #233 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #234 0x42e869 in Do_Function ../src/core/c-function.c:415
    #235 0x413628 in Do_Next ../src/core/c-do.c:884
    #236 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #237 0x48459c in N_if ../src/core/n-control.c:619
    #238 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #239 0x413628 in Do_Next ../src/core/c-do.c:884
    #240 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #241 0x42e869 in Do_Function ../src/core/c-function.c:415
    #242 0x413628 in Do_Next ../src/core/c-do.c:884
    #243 0x41309b in Do_Next ../src/core/c-do.c:858
    #244 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #245 0x42e869 in Do_Function ../src/core/c-function.c:415
    #246 0x413628 in Do_Next ../src/core/c-do.c:884
    #247 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #248 0x48459c in N_if ../src/core/n-control.c:619
    #249 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #250 0x413628 in Do_Next ../src/core/c-do.c:884
    #251 0x414825 in Do_Blk ../src/core/c-do.c:1010

0x62a00000b201 is located 1 bytes to the right of 20480-byte region [0x62a000006200,0x62a00000b200)
allocated by thread T0 here:
    #0 0x7ffff6f58b1f in malloc (/usr/lib/libasan.so.1+0x54b1f)
    #1 0x47924a in Make_Mem ../src/core/m-pools.c:121
    #2 0x47a9ff in Make_Series ../src/core/m-pools.c:406
    #3 0x4aee84 in Make_Unicode ../src/core/s-make.c:59
    #4 0x4bb797 in Init_Mold ../src/core/s-mold.c:1425
    #5 0x40da64 in Init_Core ../src/core/b-init.c:940
    #6 0x4055e0 in RL_Init ../src/core/a-lib.c:124
    #7 0x580aa2 in main ../src/os/host-main.c:154
    #8 0x7ffff5719fff in __libc_start_main (/usr/lib/libc.so.6+0x1ffff)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:145 Expand_Series
Shadow bytes around the buggy address:
  0x0c547fff95f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c547fff9640:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:
3d7484c
@zsx zsx added a commit to zsx/r3 that referenced this issue Oct 15, 2014
@zsx zsx Fix a heap-buffer-overflow
Found by AddressSanitizer:
==8157==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d0000f5897 at pc 0x4816ef bp 0x7fffffffafb0 sp 0x7fffffffafa0
READ of size 1 at 0x61d0000f5897 thread T0
    #0 0x4816ee in Expand_Series ../src/core/m-series.c:138
    #1 0x4e258c in Insert_Gobs ../src/core/t-gob.c:219
    #2 0x4e7782 in T_Gob ../src/core/t-gob.c:833
    #3 0x42e26f in Do_Act ../src/core/c-function.c:338
    #4 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #5 0x41395b in Do_Next ../src/core/c-do.c:886
    #6 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #7 0x4883d6 in N_if ../src/core/n-control.c:632
    #8 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #9 0x41395b in Do_Next ../src/core/c-do.c:886
    #10 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #11 0x4893c0 in N_unless ../src/core/n-control.c:792
    #12 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #13 0x41395b in Do_Next ../src/core/c-do.c:886
    #14 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #15 0x488c03 in N_switch ../src/core/n-control.c:736
    #16 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #17 0x41395b in Do_Next ../src/core/c-do.c:886
    #18 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #19 0x4883d6 in N_if ../src/core/n-control.c:632
    #20 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #21 0x41395b in Do_Next ../src/core/c-do.c:886
    #22 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #23 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #24 0x41395b in Do_Next ../src/core/c-do.c:886
    #25 0x415658 in Try_Block ../src/core/c-do.c:1083
    #26 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #27 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #28 0x41395b in Do_Next ../src/core/c-do.c:886
    #29 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #30 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #31 0x49693a in N_for ../src/core/n-loop.c:486
    #32 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #33 0x41395b in Do_Next ../src/core/c-do.c:886
    #34 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #35 0x4883d6 in N_if ../src/core/n-control.c:632
    #36 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #37 0x41395b in Do_Next ../src/core/c-do.c:886
    #38 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #39 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #40 0x41395b in Do_Next ../src/core/c-do.c:886
    #41 0x415658 in Try_Block ../src/core/c-do.c:1083
    #42 0x488f7d in N_try ../src/core/n-control.c:760
    #43 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #44 0x41395b in Do_Next ../src/core/c-do.c:886
    #45 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #46 0x413700 in Do_Next ../src/core/c-do.c:879
    #47 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #48 0x413700 in Do_Next ../src/core/c-do.c:879
    #49 0x414f2f in Do_Block_Value_Throw ../src/core/c-do.c:1048
    #50 0x5725ac in Parse_Rules_Loop ../src/core/u-parse.c:830
    #51 0x5731f8 in Parse_Rules_Loop ../src/core/u-parse.c:927
    #52 0x56c799 in Parse_Series ../src/core/u-parse.c:96
    #53 0x576950 in N_parse ../src/core/u-parse.c:1269
    #54 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #55 0x41395b in Do_Next ../src/core/c-do.c:886
    #56 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #57 0x4883d6 in N_if ../src/core/n-control.c:632
    #58 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #59 0x41395b in Do_Next ../src/core/c-do.c:886
    #60 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #61 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #62 0x41395b in Do_Next ../src/core/c-do.c:886
    #63 0x415658 in Try_Block ../src/core/c-do.c:1083
    #64 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #65 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #66 0x41395b in Do_Next ../src/core/c-do.c:886
    #67 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #68 0x487b91 in N_do ../src/core/n-control.c:524
    #69 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #70 0x41395b in Do_Next ../src/core/c-do.c:886
    #71 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #72 0x487fcb in N_either ../src/core/n-control.c:598
    #73 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #74 0x41395b in Do_Next ../src/core/c-do.c:886
    #75 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #76 0x487fcb in N_either ../src/core/n-control.c:598
    #77 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #78 0x41395b in Do_Next ../src/core/c-do.c:886
    #79 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #80 0x487fcb in N_either ../src/core/n-control.c:598
    #81 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #82 0x41395b in Do_Next ../src/core/c-do.c:886
    #83 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #84 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #85 0x4198c2 in Apply_Function ../src/core/c-do.c:1524
    #86 0x419fa8 in Do_Sys_Func ../src/core/c-do.c:1584
    #87 0x41e406 in Init_Mezz ../src/core/c-do.c:2313
    #88 0x405fd3 in RL_Start ../src/core/a-lib.c:167
    #89 0x59d1f7 in main ../src/os/host-main.c:231
    #90 0x7ffff571403f in __libc_start_main (/usr/lib/libc.so.6+0x2003f)
    #91 0x405858 (/home/zsx/work/r3.git/make/r3-view-linux+0x405858)

0x61d0000f5897 is located 7 bytes to the right of 2064-byte region [0x61d0000f5080,0x61d0000f5890)
allocated by thread T0 here:
    #0 0x7ffff6f56b77 in __interceptor_malloc (/usr/lib/libasan.so.1+0x57b77)
    #1 0x47c300 in Make_Mem ../src/core/m-pools.c:125
    #2 0x47ca2f in Fill_Pool ../src/core/m-pools.c:233
    #3 0x47d80c in Make_Series ../src/core/m-pools.c:388
    #4 0x4826f3 in Copy_Series ../src/core/m-series.c:261
    #5 0x43ca14 in Copy_Deep_Values ../src/core/f-blocks.c:131
    #6 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #7 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #8 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #9 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #10 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #11 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #12 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #13 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #14 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #15 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #16 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #17 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #18 0x43cd9f in Clone_Block ../src/core/f-blocks.c:174
    #19 0x42db12 in Clone_Function ../src/core/c-function.c:266
    #20 0x43cc00 in Copy_Deep_Values ../src/core/f-blocks.c:139
    #21 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #22 0x4fd371 in T_Object ../src/core/t-object.c:364
    #23 0x42e26f in Do_Act ../src/core/c-function.c:338
    #24 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #25 0x41395b in Do_Next ../src/core/c-do.c:886
    #26 0x4133cc in Do_Next ../src/core/c-do.c:860
    #27 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #28 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #29 0x49693a in N_for ../src/core/n-loop.c:486

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:138 Expand_Series
Shadow bytes around the buggy address:
  0x0c3a80016ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a80016b10: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==8157==ABORTING

This is happening because "GOB_TAIL(gob) = count" sets the tail of a
series with length of "count" to be "count", and Expand_Series expects
a terminator in the series. (m-series.c:90 size  = (series->tail + 1) * wide;)
758d800
@zsx zsx added a commit to zsx/r3 that referenced this issue Oct 15, 2014
@zsx zsx Fix a heap-buffer-overflow
Found by AddressSanitizer:
==8157==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d0000f5897 at pc 0x4816ef bp 0x7fffffffafb0 sp 0x7fffffffafa0
READ of size 1 at 0x61d0000f5897 thread T0
    #0 0x4816ee in Expand_Series ../src/core/m-series.c:138
    #1 0x4e258c in Insert_Gobs ../src/core/t-gob.c:219
    #2 0x4e7782 in T_Gob ../src/core/t-gob.c:833
    #3 0x42e26f in Do_Act ../src/core/c-function.c:338
    #4 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #5 0x41395b in Do_Next ../src/core/c-do.c:886
    #6 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #7 0x4883d6 in N_if ../src/core/n-control.c:632
    #8 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #9 0x41395b in Do_Next ../src/core/c-do.c:886
    #10 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #11 0x4893c0 in N_unless ../src/core/n-control.c:792
    #12 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #13 0x41395b in Do_Next ../src/core/c-do.c:886
    #14 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #15 0x488c03 in N_switch ../src/core/n-control.c:736
    #16 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #17 0x41395b in Do_Next ../src/core/c-do.c:886
    #18 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #19 0x4883d6 in N_if ../src/core/n-control.c:632
    #20 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #21 0x41395b in Do_Next ../src/core/c-do.c:886
    #22 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #23 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #24 0x41395b in Do_Next ../src/core/c-do.c:886
    #25 0x415658 in Try_Block ../src/core/c-do.c:1083
    #26 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #27 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #28 0x41395b in Do_Next ../src/core/c-do.c:886
    #29 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #30 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #31 0x49693a in N_for ../src/core/n-loop.c:486
    #32 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #33 0x41395b in Do_Next ../src/core/c-do.c:886
    #34 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #35 0x4883d6 in N_if ../src/core/n-control.c:632
    #36 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #37 0x41395b in Do_Next ../src/core/c-do.c:886
    #38 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #39 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #40 0x41395b in Do_Next ../src/core/c-do.c:886
    #41 0x415658 in Try_Block ../src/core/c-do.c:1083
    #42 0x488f7d in N_try ../src/core/n-control.c:760
    #43 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #44 0x41395b in Do_Next ../src/core/c-do.c:886
    #45 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #46 0x413700 in Do_Next ../src/core/c-do.c:879
    #47 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #48 0x413700 in Do_Next ../src/core/c-do.c:879
    #49 0x414f2f in Do_Block_Value_Throw ../src/core/c-do.c:1048
    #50 0x5725ac in Parse_Rules_Loop ../src/core/u-parse.c:830
    #51 0x5731f8 in Parse_Rules_Loop ../src/core/u-parse.c:927
    #52 0x56c799 in Parse_Series ../src/core/u-parse.c:96
    #53 0x576950 in N_parse ../src/core/u-parse.c:1269
    #54 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #55 0x41395b in Do_Next ../src/core/c-do.c:886
    #56 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #57 0x4883d6 in N_if ../src/core/n-control.c:632
    #58 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #59 0x41395b in Do_Next ../src/core/c-do.c:886
    #60 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #61 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #62 0x41395b in Do_Next ../src/core/c-do.c:886
    #63 0x415658 in Try_Block ../src/core/c-do.c:1083
    #64 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #65 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #66 0x41395b in Do_Next ../src/core/c-do.c:886
    #67 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #68 0x487b91 in N_do ../src/core/n-control.c:524
    #69 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #70 0x41395b in Do_Next ../src/core/c-do.c:886
    #71 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #72 0x487fcb in N_either ../src/core/n-control.c:598
    #73 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #74 0x41395b in Do_Next ../src/core/c-do.c:886
    #75 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #76 0x487fcb in N_either ../src/core/n-control.c:598
    #77 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #78 0x41395b in Do_Next ../src/core/c-do.c:886
    #79 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #80 0x487fcb in N_either ../src/core/n-control.c:598
    #81 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #82 0x41395b in Do_Next ../src/core/c-do.c:886
    #83 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #84 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #85 0x4198c2 in Apply_Function ../src/core/c-do.c:1524
    #86 0x419fa8 in Do_Sys_Func ../src/core/c-do.c:1584
    #87 0x41e406 in Init_Mezz ../src/core/c-do.c:2313
    #88 0x405fd3 in RL_Start ../src/core/a-lib.c:167
    #89 0x59d1f7 in main ../src/os/host-main.c:231
    #90 0x7ffff571403f in __libc_start_main (/usr/lib/libc.so.6+0x2003f)
    #91 0x405858 (/home/zsx/work/r3.git/make/r3-view-linux+0x405858)

0x61d0000f5897 is located 7 bytes to the right of 2064-byte region [0x61d0000f5080,0x61d0000f5890)
allocated by thread T0 here:
    #0 0x7ffff6f56b77 in __interceptor_malloc (/usr/lib/libasan.so.1+0x57b77)
    #1 0x47c300 in Make_Mem ../src/core/m-pools.c:125
    #2 0x47ca2f in Fill_Pool ../src/core/m-pools.c:233
    #3 0x47d80c in Make_Series ../src/core/m-pools.c:388
    #4 0x4826f3 in Copy_Series ../src/core/m-series.c:261
    #5 0x43ca14 in Copy_Deep_Values ../src/core/f-blocks.c:131
    #6 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #7 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #8 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #9 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #10 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #11 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #12 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #13 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #14 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #15 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #16 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #17 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #18 0x43cd9f in Clone_Block ../src/core/f-blocks.c:174
    #19 0x42db12 in Clone_Function ../src/core/c-function.c:266
    #20 0x43cc00 in Copy_Deep_Values ../src/core/f-blocks.c:139
    #21 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #22 0x4fd371 in T_Object ../src/core/t-object.c:364
    #23 0x42e26f in Do_Act ../src/core/c-function.c:338
    #24 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #25 0x41395b in Do_Next ../src/core/c-do.c:886
    #26 0x4133cc in Do_Next ../src/core/c-do.c:860
    #27 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #28 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #29 0x49693a in N_for ../src/core/n-loop.c:486

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:138 Expand_Series
Shadow bytes around the buggy address:
  0x0c3a80016ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a80016b10: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==8157==ABORTING

This is happening because "GOB_TAIL(gob) = count" sets the tail of a
series with length of "count" to be "count", and Expand_Series expects
a terminator in the series. (m-series.c:90 size  = (series->tail + 1) * wide;)
f47d17f
@zsx zsx added a commit to zsx/r3 that referenced this issue May 14, 2015
@zsx zsx Fix an alloc-dealloc-mismatch
Found by GCC Address Sanitizer:

=================================================================
==32465==ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete []) on 0x6030000add40
    #0 0x7f012194676f in operator delete[](void*) (/usr/lib/libasan.so.1+0x5876f)
    #1 0x6c8785 in agg::agg_graphics::agg_reset() ../src/agg/agg_graphics.cpp:1562
    #2 0x6bc20c in agg::agg_graphics::~agg_graphics() ../src/agg/agg_graphics.cpp:96
    #3 0x66fb18 in rebdrw_gob_draw ../src/os/host-draw-api-agg.cpp:571
    #4 0x678500 in process_gobs ../src/os/linux/host-compositor.c:520
    #5 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #6 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #7 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #8 0x67b63f in rebcmp_compose ../src/os/linux/host-compositor.c:685
    #9 0x65158c in Draw_Window ../src/os/host-view.c:225
    #10 0x651b21 in Show_Gob ../src/os/host-view.c:288
    #11 0x6520ed in RXD_Graphics ../src/os/host-view.c:346
    #12 0x471ccd in Do_Command ../src/core/f-extension.c:456
    #13 0x419332 in Do_Next ../src/core/c-do.c:886
    #14 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #15 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #16 0x419332 in Do_Next ../src/core/c-do.c:886
    #17 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #18 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #19 0x419332 in Do_Next ../src/core/c-do.c:886
    #20 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #21 0x4a6c9a in N_do ../src/core/n-control.c:524
    #22 0x43e037 in Do_Native ../src/core/c-function.c:289
    #23 0x419332 in Do_Next ../src/core/c-do.c:886
    #24 0x41b643 in Try_Block ../src/core/c-do.c:1087
    #25 0x4a872e in N_try ../src/core/n-control.c:760
    #26 0x43e037 in Do_Native ../src/core/c-function.c:289
    #27 0x419332 in Do_Next ../src/core/c-do.c:886
    #28 0x4168bd in Do_Args ../src/core/c-do.c:668
    #29 0x41a070 in Do_Next ../src/core/c-do.c:942
    #30 0x4168bd in Do_Args ../src/core/c-do.c:668
    #31 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #32 0x4168bd in Do_Args ../src/core/c-do.c:668
    #33 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #34 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #35 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #36 0x419332 in Do_Next ../src/core/c-do.c:886
    #37 0x4168bd in Do_Args ../src/core/c-do.c:668
    #38 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #39 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #40 0x4a6c9a in N_do ../src/core/n-control.c:524
    #41 0x43e037 in Do_Native ../src/core/c-function.c:289
    #42 0x419332 in Do_Next ../src/core/c-do.c:886
    #43 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #44 0x4a732e in N_either ../src/core/n-control.c:598
    #45 0x43e037 in Do_Native ../src/core/c-function.c:289
    #46 0x419332 in Do_Next ../src/core/c-do.c:886
    #47 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #48 0x4a732e in N_either ../src/core/n-control.c:598
    #49 0x43e037 in Do_Native ../src/core/c-function.c:289
    #50 0x419332 in Do_Next ../src/core/c-do.c:886
    #51 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #52 0x4a732e in N_either ../src/core/n-control.c:598
    #53 0x43e037 in Do_Native ../src/core/c-function.c:289
    #54 0x419332 in Do_Next ../src/core/c-do.c:886
    #55 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #56 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #57 0x42094d in Apply_Function ../src/core/c-do.c:1528
    #58 0x42116c in Do_Sys_Func ../src/core/c-do.c:1588
    #59 0x426d54 in Init_Mezz ../src/core/c-do.c:2320
    #60 0x4069c1 in RL_Start ../src/core/a-lib.c:193
    #61 0x5fea9d in main ../src/os/host-main.c:235
    #62 0x7f011fed27ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #63 0x405dd8 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x405dd8)

0x6030000add40 is located 0 bytes inside of 24-byte region [0x6030000add40,0x6030000add58)
allocated by thread T0 here:
    #0 0x7f01219457a7 in malloc (/usr/lib/libasan.so.1+0x577a7)
    #1 0x606495 in OS_Make ../src/os/linux/host-lib.c:380
    #2 0x664b61 in RXD_Draw ../src/os/host-draw.c:438
    #3 0x472f24 in Do_Commands ../src/core/f-extension.c:585
    #4 0x4073a0 in RL_Do_Commands ../src/core/a-lib.c:402
    #5 0x66fadb in rebdrw_gob_draw ../src/os/host-draw-api-agg.cpp:568
    #6 0x678500 in process_gobs ../src/os/linux/host-compositor.c:520
    #7 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #8 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #9 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #10 0x67b63f in rebcmp_compose ../src/os/linux/host-compositor.c:685
    #11 0x65158c in Draw_Window ../src/os/host-view.c:225
    #12 0x651b21 in Show_Gob ../src/os/host-view.c:288
    #13 0x6520ed in RXD_Graphics ../src/os/host-view.c:346
    #14 0x471ccd in Do_Command ../src/core/f-extension.c:456
    #15 0x419332 in Do_Next ../src/core/c-do.c:886
    #16 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #17 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #18 0x419332 in Do_Next ../src/core/c-do.c:886
    #19 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #20 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #21 0x419332 in Do_Next ../src/core/c-do.c:886
    #22 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #23 0x4a6c9a in N_do ../src/core/n-control.c:524
    #24 0x43e037 in Do_Native ../src/core/c-function.c:289
    #25 0x419332 in Do_Next ../src/core/c-do.c:886
    #26 0x41b643 in Try_Block ../src/core/c-do.c:1087
    #27 0x4a872e in N_try ../src/core/n-control.c:760
    #28 0x43e037 in Do_Native ../src/core/c-function.c:289
    #29 0x419332 in Do_Next ../src/core/c-do.c:886

SUMMARY: AddressSanitizer: alloc-dealloc-mismatch ??:0 operator delete[](void*)
==32465==HINT: if you don't care about these warnings you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==32465==ABORTING
1519a11
@zsx zsx added a commit to zsx/r3 that referenced this issue May 19, 2015
@zsx zsx Remove free'd serieses from GC_Infants
reported by address sanitizer with manual poisonation:

=================================================================
==11513==ERROR: AddressSanitizer: use-after-poison on address 0x7efe281542c0 at pc 0x00000071038f bp 0x7ffdc9de9330 sp 0x7ffdc9de9328
READ of size 4 at 0x7efe281542c0 thread T0
    #0 0x71038e in Mark_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501:6
    #1 0x70ea8b in Recycle /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:744:4
    #2 0x7bbde6 in N_recycle /home/zsx/stuffs/work/r3.git/make/../src/core/n-system.c:99:10
    #3 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #4 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #5 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #6 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #7 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #8 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #9 0xb0b6d9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #10 0xb0e7f7 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #11 0xb07b10 in Parse_Series /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:96:9
    #12 0xb06b65 in N_parse /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:1269:7
    #13 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #14 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #19 0x745e54 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #20 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #21 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #22 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #23 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #24 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #25 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #26 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #27 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #28 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #29 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #30 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #31 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #32 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #33 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #34 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #35 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #36 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #37 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #38 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #39 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #40 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #41 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #42 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #43 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #44 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #45 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #46 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #47 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #48 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #49 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #50 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #51 0x582548 in Init_Mezz /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:2320:9
    #52 0x52e62f in RL_Start /home/zsx/stuffs/work/r3.git/make/../src/core/a-lib.c:193:9
    #53 0xbb6c93 in main /home/zsx/stuffs/work/r3.git/make/../src/os/host-main.c:235:6
    #54 0x7efe2bfcb7ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #55 0x486498 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x486498)

0x7efe281542c0 is located 96960 bytes inside of 131088-byte region [0x7efe2813c800,0x7efe2815c810)
allocated by thread T0 here:
    #0 0x50d462 in __interceptor_malloc (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x50d462)
    #1 0x721a85 in Make_Mem /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:127:14
    #2 0x723acd in Fill_Pool /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:235:19
    #3 0x7233af in Make_Node /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:280:20
    #4 0x725f8a in Make_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:391:21
    #5 0x738823 in Copy_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-series.c:261:19
    #6 0x5f93a6 in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:131:22
    #7 0x5f98cf in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:136:6
    #8 0x5fa3ed in Copy_Block_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:159:18
    #9 0x89efc2 in T_Block /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:796:23
    #10 0x5c458f in Do_Act /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:338:8
    #11 0x5c5927 in Do_Action /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:396:2
    #12 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #13 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #14 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #19 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #20 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #21 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #22 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #23 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #24 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #25 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #26 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #27 0x5a37d0 in Make_Module /home/zsx/stuffs/work/r3.git/make/../src/core/c-frame.c:585:10
    #28 0x9510d5 in T_Object /home/zsx/stuffs/work/r3.git/make/../src/core/t-object.c:308:16
    #29 0x8ac4eb in T_Datatype /home/zsx/stuffs/work/r3.git/make/../src/core/t-datatype.c:92:20

SUMMARY: AddressSanitizer: use-after-poison /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501 Mark_Series
Shadow bytes around the buggy address:
  0x0fe045022800: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
  0x0fe045022810: 00 00 00 00 00 00 f7 f7 f7 f7 00 00 00 00 00 00
  0x0fe045022820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022830: 00 00 f7 f7 f7 f7 00 00 00 00 00 00 00 00 f7 f7
  0x0fe045022840: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
=>0x0fe045022850: 00 00 00 00 00 00 f7 f7[f7]f7 00 00 00 00 00 00
  0x0fe045022860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0450228a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11513==ABORTING
9c93854
@zsx zsx added a commit to zsx/r3 that referenced this issue May 19, 2015
@zsx zsx Remove free'd serieses from GC_Infants
reported by address sanitizer with manual poisonation:

=================================================================
==11513==ERROR: AddressSanitizer: use-after-poison on address 0x7efe281542c0 at pc 0x00000071038f bp 0x7ffdc9de9330 sp 0x7ffdc9de9328
READ of size 4 at 0x7efe281542c0 thread T0
    #0 0x71038e in Mark_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501:6
    #1 0x70ea8b in Recycle /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:744:4
    #2 0x7bbde6 in N_recycle /home/zsx/stuffs/work/r3.git/make/../src/core/n-system.c:99:10
    #3 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #4 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #5 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #6 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #7 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #8 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #9 0xb0b6d9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #10 0xb0e7f7 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #11 0xb07b10 in Parse_Series /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:96:9
    #12 0xb06b65 in N_parse /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:1269:7
    #13 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #14 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #19 0x745e54 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #20 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #21 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #22 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #23 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #24 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #25 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #26 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #27 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #28 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #29 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #30 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #31 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #32 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #33 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #34 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #35 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #36 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #37 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #38 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #39 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #40 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #41 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #42 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #43 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #44 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #45 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #46 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #47 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #48 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #49 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #50 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #51 0x582548 in Init_Mezz /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:2320:9
    #52 0x52e62f in RL_Start /home/zsx/stuffs/work/r3.git/make/../src/core/a-lib.c:193:9
    #53 0xbb6c93 in main /home/zsx/stuffs/work/r3.git/make/../src/os/host-main.c:235:6
    #54 0x7efe2bfcb7ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #55 0x486498 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x486498)

0x7efe281542c0 is located 96960 bytes inside of 131088-byte region [0x7efe2813c800,0x7efe2815c810)
allocated by thread T0 here:
    #0 0x50d462 in __interceptor_malloc (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x50d462)
    #1 0x721a85 in Make_Mem /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:127:14
    #2 0x723acd in Fill_Pool /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:235:19
    #3 0x7233af in Make_Node /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:280:20
    #4 0x725f8a in Make_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:391:21
    #5 0x738823 in Copy_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-series.c:261:19
    #6 0x5f93a6 in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:131:22
    #7 0x5f98cf in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:136:6
    #8 0x5fa3ed in Copy_Block_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:159:18
    #9 0x89efc2 in T_Block /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:796:23
    #10 0x5c458f in Do_Act /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:338:8
    #11 0x5c5927 in Do_Action /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:396:2
    #12 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #13 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #14 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #19 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #20 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #21 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #22 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #23 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #24 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #25 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #26 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #27 0x5a37d0 in Make_Module /home/zsx/stuffs/work/r3.git/make/../src/core/c-frame.c:585:10
    #28 0x9510d5 in T_Object /home/zsx/stuffs/work/r3.git/make/../src/core/t-object.c:308:16
    #29 0x8ac4eb in T_Datatype /home/zsx/stuffs/work/r3.git/make/../src/core/t-datatype.c:92:20

SUMMARY: AddressSanitizer: use-after-poison /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501 Mark_Series
Shadow bytes around the buggy address:
  0x0fe045022800: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
  0x0fe045022810: 00 00 00 00 00 00 f7 f7 f7 f7 00 00 00 00 00 00
  0x0fe045022820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022830: 00 00 f7 f7 f7 f7 00 00 00 00 00 00 00 00 f7 f7
  0x0fe045022840: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
=>0x0fe045022850: 00 00 00 00 00 00 f7 f7[f7]f7 00 00 00 00 00 00
  0x0fe045022860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0450228a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11513==ABORTING
b61f8ec
@zsx zsx added a commit to zsx/r3 that referenced this issue May 21, 2015
@zsx zsx Pass correct length to Deline_*
The length of the VAL_SERIES(value) has been set correctly by
Append_UTF8, and it could be smaller than "len", because UTF8 is a
multi-byte encoding, thus passing "len" to Deline_Uni could cause
out-of-bound memory access.

Fixes CC#2169

The following code

    REBOL[]
    t: <ēee>

causes:

==13053==ERROR: AddressSanitizer: use-after-poison on address 0x61d00001a5f8 at pc 0x000000853d50 bp 0x7ffd2a31a1b0 sp 0x7ffd2a31a1a8
WRITE of size 2 at 0x61d00001a5f8 thread T0
    #0 0x853d4f in Deline_Uni /home/zsx/stuffs/work/r3.git/make/../src/core/s-ops.c:426:2
    #1 0x7064d4 in Scan_Any /home/zsx/stuffs/work/r3.git/make/../src/core/l-types.c:846:7
    #2 0x6dca3c in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1421:4
    #3 0x6d9f92 in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1301:12
    #4 0x6df0e6 in Scan_Code /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1550:9
    #5 0x6df462 in Scan_Source /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1570:9
    #6 0x896105 in Make_Block_Type /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:306:9
    #7 0x89af62 in T_Block /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:624:3
    #8 0x8ac80b in T_Datatype /home/zsx/stuffs/work/r3.git/make/../src/core/t-datatype.c:92:20
    #9 0x5c458f in Do_Act /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:338:8
    #10 0x5c5927 in Do_Action /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:396:2
    #11 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #12 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #13 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #14 0x746174 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #15 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #16 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #17 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #18 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #19 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #20 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #21 0x568295 in Try_Block /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1087:11
    #22 0x7506ac in N_try /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:760:6
    #23 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #24 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #25 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #26 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #27 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #28 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #29 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #30 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #31 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #32 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #33 0xb0b9f9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #34 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #35 0xb07e30 in Parse_Series /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:96:9
    #36 0xb06e85 in N_parse /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:1269:7
    #37 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #38 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #39 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #40 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #41 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #42 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #43 0x746174 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #44 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #45 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #46 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #47 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #48 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #49 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #50 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #51 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #52 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #53 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #54 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #55 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #56 0x749e2b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #57 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #58 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #59 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #60 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #61 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #62 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #63 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #64 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #65 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #66 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #67 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #68 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #69 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #70 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #71 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #72 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #73 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #74 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #75 0x582548 in Init_Mezz /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:2320:9
    #76 0x52e62f in RL_Start /home/zsx/stuffs/work/r3.git/make/../src/core/a-lib.c:193:9
    #77 0xbb6fb3 in main /home/zsx/stuffs/work/r3.git/make/../src/os/host-main.c:235:6
    #78 0x7fd1c04ef7ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #79 0x486498 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x486498)

0x61d00001a5f8 is located 376 bytes inside of 2064-byte region [0x61d00001a480,0x61d00001ac90)
allocated by thread T0 here:
    #0 0x50d462 in __interceptor_malloc (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x50d462)
    #1 0x721a85 in Make_Mem /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:132:14
    #2 0x723bed in Fill_Pool /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:240:19
    #3 0x7233c2 in Make_Node /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:295:20
    #4 0x7267f3 in Make_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:419:10
    #5 0x818d71 in Copy_String /home/zsx/stuffs/work/r3.git/make/../src/core/s-make.c:337:8
    #6 0x6dc386 in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1388:22
    #7 0x6df0e6 in Scan_Code /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1550:9
    #8 0x6e1f81 in N_transcode /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1630:8
    #9 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #10 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #11 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #12 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #13 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #14 0x56110f in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:942:13
    #15 0x568295 in Try_Block /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1087:11
    #16 0x7506ac in N_try /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:760:6
    #17 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #18 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #19 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #20 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #21 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #22 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #23 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #24 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #25 0xb0b9f9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #26 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #27 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #28 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #29 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9

SUMMARY: AddressSanitizer: use-after-poison /home/zsx/stuffs/work/r3.git/make/../src/core/s-ops.c:426 Deline_Uni
Shadow bytes around the buggy address:
  0x0c3a7fffb460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb490: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c3a7fffb4b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 f7 00 00[f7]
  0x0c3a7fffb4c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb500: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==13053==ABORTING
961cd59
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Do not increase tail before extension
It will confuse Expand_Series expects "tail" to be the actual size, and
cause a read beyond the allocated memory, or heap buffer overflow found
by address sanitizer of GCC:
=================================================================
==10856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00000b201 at pc 0x47df61 bp 0x7fffffff2ca0 sp 0x7fffffff2c98
READ of size 1 at 0x62a00000b201 thread T0
    #0 0x47df60 in Expand_Series ../src/core/m-series.c:145
    #1 0x47e5a7 in Extend_Series ../src/core/m-series.c:187
    #2 0x466e0c in Scan_Quote ../src/core/l-scan.c:462
    #3 0x46a797 in Scan_Token ../src/core/l-scan.c:918
    #4 0x46e263 in Scan_Block ../src/core/l-scan.c:1188
    #5 0x46e722 in Scan_Code ../src/core/l-scan.c:1548
    #6 0x46e886 in Scan_Source ../src/core/l-scan.c:1568
    #7 0x4cb85c in Make_Block_Type ../src/core/t-block.c:306
    #8 0x4cd1b8 in T_Block ../src/core/t-block.c:608
    #9 0x4d042e in T_Datatype ../src/core/t-datatype.c:92
    #10 0x42e080 in Do_Act ../src/core/c-function.c:338
    #11 0x42e7e5 in Do_Action ../src/core/c-function.c:396
    #12 0x413628 in Do_Next ../src/core/c-do.c:884
    #13 0x41309b in Do_Next ../src/core/c-do.c:858
    #14 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #15 0x482dd2 in N_case ../src/core/n-control.c:349
    #16 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #17 0x413628 in Do_Next ../src/core/c-do.c:884
    #18 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #19 0x42e869 in Do_Function ../src/core/c-function.c:415
    #20 0x413628 in Do_Next ../src/core/c-do.c:884
    #21 0x41309b in Do_Next ../src/core/c-do.c:858
    #22 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #23 0x42e869 in Do_Function ../src/core/c-function.c:415
    #24 0x413628 in Do_Next ../src/core/c-do.c:884
    #25 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #26 0x414152 in Do_Next ../src/core/c-do.c:939
    #27 0x48201c in N_all ../src/core/n-control.c:261
    #28 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #29 0x413628 in Do_Next ../src/core/c-do.c:884
    #30 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #31 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #32 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #33 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #34 0x413628 in Do_Next ../src/core/c-do.c:884
    #35 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #36 0x42e869 in Do_Function ../src/core/c-function.c:415
    #37 0x413628 in Do_Next ../src/core/c-do.c:884
    #38 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #39 0x414152 in Do_Next ../src/core/c-do.c:939
    #40 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #41 0x48459c in N_if ../src/core/n-control.c:619
    #42 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #43 0x413628 in Do_Next ../src/core/c-do.c:884
    #44 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #45 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #46 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #47 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #48 0x413628 in Do_Next ../src/core/c-do.c:884
    #49 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #50 0x42e869 in Do_Function ../src/core/c-function.c:415
    #51 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #52 0x4824fb in N_apply ../src/core/n-control.c:295
    #53 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #54 0x413628 in Do_Next ../src/core/c-do.c:884
    #55 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #56 0x414152 in Do_Next ../src/core/c-do.c:939
    #57 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #58 0x485388 in N_unless ../src/core/n-control.c:763
    #59 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #60 0x413628 in Do_Next ../src/core/c-do.c:884
    #61 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #62 0x483eff in N_do ../src/core/n-control.c:523
    #63 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #64 0x413628 in Do_Next ../src/core/c-do.c:884
    #65 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #66 0x414152 in Do_Next ../src/core/c-do.c:939
    #67 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #68 0x48459c in N_if ../src/core/n-control.c:619
    #69 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #70 0x413628 in Do_Next ../src/core/c-do.c:884
    #71 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #72 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #73 0x49314d in N_repeat ../src/core/n-loop.c:631
    #74 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #75 0x413628 in Do_Next ../src/core/c-do.c:884
    #76 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #77 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #78 0x413628 in Do_Next ../src/core/c-do.c:884
    #79 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #80 0x485388 in N_unless ../src/core/n-control.c:763
    #81 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #82 0x413628 in Do_Next ../src/core/c-do.c:884
    #83 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #84 0x42e869 in Do_Function ../src/core/c-function.c:415
    #85 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #86 0x4824fb in N_apply ../src/core/n-control.c:295
    #87 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #88 0x413628 in Do_Next ../src/core/c-do.c:884
    #89 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #90 0x414152 in Do_Next ../src/core/c-do.c:939
    #91 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #92 0x485388 in N_unless ../src/core/n-control.c:763
    #93 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #94 0x413628 in Do_Next ../src/core/c-do.c:884
    #95 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #96 0x483eff in N_do ../src/core/n-control.c:523
    #97 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #98 0x413628 in Do_Next ../src/core/c-do.c:884
    #99 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #100 0x414152 in Do_Next ../src/core/c-do.c:939
    #101 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #102 0x48459c in N_if ../src/core/n-control.c:619
    #103 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #104 0x413628 in Do_Next ../src/core/c-do.c:884
    #105 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #106 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #107 0x49314d in N_repeat ../src/core/n-loop.c:631
    #108 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #109 0x413628 in Do_Next ../src/core/c-do.c:884
    #110 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #111 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #112 0x413628 in Do_Next ../src/core/c-do.c:884
    #113 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #114 0x485388 in N_unless ../src/core/n-control.c:763
    #115 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #116 0x413628 in Do_Next ../src/core/c-do.c:884
    #117 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #118 0x42e869 in Do_Function ../src/core/c-function.c:415
    #119 0x413628 in Do_Next ../src/core/c-do.c:884
    #120 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #121 0x484cf1 in N_switch ../src/core/n-control.c:716
    #122 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #123 0x413628 in Do_Next ../src/core/c-do.c:884
    #124 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #125 0x42e869 in Do_Function ../src/core/c-function.c:415
    #126 0x413628 in Do_Next ../src/core/c-do.c:884
    #127 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #128 0x48459c in N_if ../src/core/n-control.c:619
    #129 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #130 0x413628 in Do_Next ../src/core/c-do.c:884
    #131 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #132 0x42e869 in Do_Function ../src/core/c-function.c:415
    #133 0x413628 in Do_Next ../src/core/c-do.c:884
    #134 0x41309b in Do_Next ../src/core/c-do.c:858
    #135 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #136 0x484280 in N_either ../src/core/n-control.c:595
    #137 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #138 0x413628 in Do_Next ../src/core/c-do.c:884
    #139 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #140 0x42e869 in Do_Function ../src/core/c-function.c:415
    #141 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #142 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #143 0x48d102 in N_wake_up ../src/core/n-io.c:415
    #144 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #145 0x413628 in Do_Next ../src/core/c-do.c:884
    #146 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #147 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #148 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #149 0x492b66 in N_loop ../src/core/n-loop.c:590
    #150 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #151 0x413628 in Do_Next ../src/core/c-do.c:884
    #152 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #153 0x42e869 in Do_Function ../src/core/c-function.c:415
    #154 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #155 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #156 0x42fef7 in Awake_System ../src/core/c-port.c:198
    #157 0x43012a in Wait_Ports ../src/core/c-port.c:231
    #158 0x48cd62 in N_wait ../src/core/n-io.c:374
    #159 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #160 0x413628 in Do_Next ../src/core/c-do.c:884
    #161 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #162 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #163 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #164 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #165 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #166 0x4929a7 in N_forever ../src/core/n-loop.c:527
    #167 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #168 0x413628 in Do_Next ../src/core/c-do.c:884
    #169 0x4152ff in Try_Block ../src/core/c-do.c:1077
    #170 0x48507e in N_try ../src/core/n-control.c:740
    #171 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #172 0x413628 in Do_Next ../src/core/c-do.c:884
    #173 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #174 0x414152 in Do_Next ../src/core/c-do.c:939
    #175 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #176 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #177 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #178 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #179 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #180 0x42e869 in Do_Function ../src/core/c-function.c:415
    #181 0x413628 in Do_Next ../src/core/c-do.c:884
    #182 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #183 0x48459c in N_if ../src/core/n-control.c:619
    #184 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #185 0x413628 in Do_Next ../src/core/c-do.c:884
    #186 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #187 0x42e869 in Do_Function ../src/core/c-function.c:415
    #188 0x413628 in Do_Next ../src/core/c-do.c:884
    #189 0x41309b in Do_Next ../src/core/c-do.c:858
    #190 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #191 0x42e869 in Do_Function ../src/core/c-function.c:415
    #192 0x413628 in Do_Next ../src/core/c-do.c:884
    #193 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #194 0x42e869 in Do_Function ../src/core/c-function.c:415
    #195 0x413628 in Do_Next ../src/core/c-do.c:884
    #196 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #197 0x414152 in Do_Next ../src/core/c-do.c:939
    #198 0x48201c in N_all ../src/core/n-control.c:261
    #199 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #200 0x413628 in Do_Next ../src/core/c-do.c:884
    #201 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #202 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #203 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #204 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #205 0x413628 in Do_Next ../src/core/c-do.c:884
    #206 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #207 0x42e869 in Do_Function ../src/core/c-function.c:415
    #208 0x413628 in Do_Next ../src/core/c-do.c:884
    #209 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #210 0x485388 in N_unless ../src/core/n-control.c:763
    #211 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #212 0x413628 in Do_Next ../src/core/c-do.c:884
    #213 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #214 0x42e869 in Do_Function ../src/core/c-function.c:415
    #215 0x413628 in Do_Next ../src/core/c-do.c:884
    #216 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #217 0x48459c in N_if ../src/core/n-control.c:619
    #218 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #219 0x413628 in Do_Next ../src/core/c-do.c:884
    #220 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #221 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #222 0x413628 in Do_Next ../src/core/c-do.c:884
    #223 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #224 0x414152 in Do_Next ../src/core/c-do.c:939
    #225 0x48201c in N_all ../src/core/n-control.c:261
    #226 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #227 0x413628 in Do_Next ../src/core/c-do.c:884
    #228 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #229 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #230 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #231 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #232 0x413628 in Do_Next ../src/core/c-do.c:884
    #233 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #234 0x42e869 in Do_Function ../src/core/c-function.c:415
    #235 0x413628 in Do_Next ../src/core/c-do.c:884
    #236 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #237 0x48459c in N_if ../src/core/n-control.c:619
    #238 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #239 0x413628 in Do_Next ../src/core/c-do.c:884
    #240 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #241 0x42e869 in Do_Function ../src/core/c-function.c:415
    #242 0x413628 in Do_Next ../src/core/c-do.c:884
    #243 0x41309b in Do_Next ../src/core/c-do.c:858
    #244 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #245 0x42e869 in Do_Function ../src/core/c-function.c:415
    #246 0x413628 in Do_Next ../src/core/c-do.c:884
    #247 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #248 0x48459c in N_if ../src/core/n-control.c:619
    #249 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #250 0x413628 in Do_Next ../src/core/c-do.c:884
    #251 0x414825 in Do_Blk ../src/core/c-do.c:1010

0x62a00000b201 is located 1 bytes to the right of 20480-byte region [0x62a000006200,0x62a00000b200)
allocated by thread T0 here:
    #0 0x7ffff6f58b1f in malloc (/usr/lib/libasan.so.1+0x54b1f)
    #1 0x47924a in Make_Mem ../src/core/m-pools.c:121
    #2 0x47a9ff in Make_Series ../src/core/m-pools.c:406
    #3 0x4aee84 in Make_Unicode ../src/core/s-make.c:59
    #4 0x4bb797 in Init_Mold ../src/core/s-mold.c:1425
    #5 0x40da64 in Init_Core ../src/core/b-init.c:940
    #6 0x4055e0 in RL_Init ../src/core/a-lib.c:124
    #7 0x580aa2 in main ../src/os/host-main.c:154
    #8 0x7ffff5719fff in __libc_start_main (/usr/lib/libc.so.6+0x1ffff)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:145 Expand_Series
Shadow bytes around the buggy address:
  0x0c547fff95f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c547fff9640:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:
a54820d
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Fix a heap-buffer-overflow
Found by AddressSanitizer:
==8157==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d0000f5897 at pc 0x4816ef bp 0x7fffffffafb0 sp 0x7fffffffafa0
READ of size 1 at 0x61d0000f5897 thread T0
    #0 0x4816ee in Expand_Series ../src/core/m-series.c:138
    #1 0x4e258c in Insert_Gobs ../src/core/t-gob.c:219
    #2 0x4e7782 in T_Gob ../src/core/t-gob.c:833
    #3 0x42e26f in Do_Act ../src/core/c-function.c:338
    #4 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #5 0x41395b in Do_Next ../src/core/c-do.c:886
    #6 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #7 0x4883d6 in N_if ../src/core/n-control.c:632
    #8 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #9 0x41395b in Do_Next ../src/core/c-do.c:886
    #10 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #11 0x4893c0 in N_unless ../src/core/n-control.c:792
    #12 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #13 0x41395b in Do_Next ../src/core/c-do.c:886
    #14 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #15 0x488c03 in N_switch ../src/core/n-control.c:736
    #16 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #17 0x41395b in Do_Next ../src/core/c-do.c:886
    #18 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #19 0x4883d6 in N_if ../src/core/n-control.c:632
    #20 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #21 0x41395b in Do_Next ../src/core/c-do.c:886
    #22 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #23 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #24 0x41395b in Do_Next ../src/core/c-do.c:886
    #25 0x415658 in Try_Block ../src/core/c-do.c:1083
    #26 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #27 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #28 0x41395b in Do_Next ../src/core/c-do.c:886
    #29 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #30 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #31 0x49693a in N_for ../src/core/n-loop.c:486
    #32 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #33 0x41395b in Do_Next ../src/core/c-do.c:886
    #34 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #35 0x4883d6 in N_if ../src/core/n-control.c:632
    #36 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #37 0x41395b in Do_Next ../src/core/c-do.c:886
    #38 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #39 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #40 0x41395b in Do_Next ../src/core/c-do.c:886
    #41 0x415658 in Try_Block ../src/core/c-do.c:1083
    #42 0x488f7d in N_try ../src/core/n-control.c:760
    #43 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #44 0x41395b in Do_Next ../src/core/c-do.c:886
    #45 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #46 0x413700 in Do_Next ../src/core/c-do.c:879
    #47 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #48 0x413700 in Do_Next ../src/core/c-do.c:879
    #49 0x414f2f in Do_Block_Value_Throw ../src/core/c-do.c:1048
    #50 0x5725ac in Parse_Rules_Loop ../src/core/u-parse.c:830
    #51 0x5731f8 in Parse_Rules_Loop ../src/core/u-parse.c:927
    #52 0x56c799 in Parse_Series ../src/core/u-parse.c:96
    #53 0x576950 in N_parse ../src/core/u-parse.c:1269
    #54 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #55 0x41395b in Do_Next ../src/core/c-do.c:886
    #56 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #57 0x4883d6 in N_if ../src/core/n-control.c:632
    #58 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #59 0x41395b in Do_Next ../src/core/c-do.c:886
    #60 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #61 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #62 0x41395b in Do_Next ../src/core/c-do.c:886
    #63 0x415658 in Try_Block ../src/core/c-do.c:1083
    #64 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #65 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #66 0x41395b in Do_Next ../src/core/c-do.c:886
    #67 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #68 0x487b91 in N_do ../src/core/n-control.c:524
    #69 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #70 0x41395b in Do_Next ../src/core/c-do.c:886
    #71 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #72 0x487fcb in N_either ../src/core/n-control.c:598
    #73 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #74 0x41395b in Do_Next ../src/core/c-do.c:886
    #75 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #76 0x487fcb in N_either ../src/core/n-control.c:598
    #77 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #78 0x41395b in Do_Next ../src/core/c-do.c:886
    #79 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #80 0x487fcb in N_either ../src/core/n-control.c:598
    #81 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #82 0x41395b in Do_Next ../src/core/c-do.c:886
    #83 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #84 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #85 0x4198c2 in Apply_Function ../src/core/c-do.c:1524
    #86 0x419fa8 in Do_Sys_Func ../src/core/c-do.c:1584
    #87 0x41e406 in Init_Mezz ../src/core/c-do.c:2313
    #88 0x405fd3 in RL_Start ../src/core/a-lib.c:167
    #89 0x59d1f7 in main ../src/os/host-main.c:231
    #90 0x7ffff571403f in __libc_start_main (/usr/lib/libc.so.6+0x2003f)
    #91 0x405858 (/home/zsx/work/r3.git/make/r3-view-linux+0x405858)

0x61d0000f5897 is located 7 bytes to the right of 2064-byte region [0x61d0000f5080,0x61d0000f5890)
allocated by thread T0 here:
    #0 0x7ffff6f56b77 in __interceptor_malloc (/usr/lib/libasan.so.1+0x57b77)
    #1 0x47c300 in Make_Mem ../src/core/m-pools.c:125
    #2 0x47ca2f in Fill_Pool ../src/core/m-pools.c:233
    #3 0x47d80c in Make_Series ../src/core/m-pools.c:388
    #4 0x4826f3 in Copy_Series ../src/core/m-series.c:261
    #5 0x43ca14 in Copy_Deep_Values ../src/core/f-blocks.c:131
    #6 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #7 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #8 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #9 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #10 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #11 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #12 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #13 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #14 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #15 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #16 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #17 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #18 0x43cd9f in Clone_Block ../src/core/f-blocks.c:174
    #19 0x42db12 in Clone_Function ../src/core/c-function.c:266
    #20 0x43cc00 in Copy_Deep_Values ../src/core/f-blocks.c:139
    #21 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #22 0x4fd371 in T_Object ../src/core/t-object.c:364
    #23 0x42e26f in Do_Act ../src/core/c-function.c:338
    #24 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #25 0x41395b in Do_Next ../src/core/c-do.c:886
    #26 0x4133cc in Do_Next ../src/core/c-do.c:860
    #27 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #28 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #29 0x49693a in N_for ../src/core/n-loop.c:486

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:138 Expand_Series
Shadow bytes around the buggy address:
  0x0c3a80016ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a80016b10: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==8157==ABORTING

This is happening because "GOB_TAIL(gob) = count" sets the tail of a
series with length of "count" to be "count", and Expand_Series expects
a terminator in the series. (m-series.c:90 size  = (series->tail + 1) * wide;)
41a6769
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Fix an alloc-dealloc-mismatch
Found by GCC Address Sanitizer:

=================================================================
==32465==ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete []) on 0x6030000add40
    #0 0x7f012194676f in operator delete[](void*) (/usr/lib/libasan.so.1+0x5876f)
    #1 0x6c8785 in agg::agg_graphics::agg_reset() ../src/agg/agg_graphics.cpp:1562
    #2 0x6bc20c in agg::agg_graphics::~agg_graphics() ../src/agg/agg_graphics.cpp:96
    #3 0x66fb18 in rebdrw_gob_draw ../src/os/host-draw-api-agg.cpp:571
    #4 0x678500 in process_gobs ../src/os/linux/host-compositor.c:520
    #5 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #6 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #7 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #8 0x67b63f in rebcmp_compose ../src/os/linux/host-compositor.c:685
    #9 0x65158c in Draw_Window ../src/os/host-view.c:225
    #10 0x651b21 in Show_Gob ../src/os/host-view.c:288
    #11 0x6520ed in RXD_Graphics ../src/os/host-view.c:346
    #12 0x471ccd in Do_Command ../src/core/f-extension.c:456
    #13 0x419332 in Do_Next ../src/core/c-do.c:886
    #14 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #15 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #16 0x419332 in Do_Next ../src/core/c-do.c:886
    #17 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #18 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #19 0x419332 in Do_Next ../src/core/c-do.c:886
    #20 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #21 0x4a6c9a in N_do ../src/core/n-control.c:524
    #22 0x43e037 in Do_Native ../src/core/c-function.c:289
    #23 0x419332 in Do_Next ../src/core/c-do.c:886
    #24 0x41b643 in Try_Block ../src/core/c-do.c:1087
    #25 0x4a872e in N_try ../src/core/n-control.c:760
    #26 0x43e037 in Do_Native ../src/core/c-function.c:289
    #27 0x419332 in Do_Next ../src/core/c-do.c:886
    #28 0x4168bd in Do_Args ../src/core/c-do.c:668
    #29 0x41a070 in Do_Next ../src/core/c-do.c:942
    #30 0x4168bd in Do_Args ../src/core/c-do.c:668
    #31 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #32 0x4168bd in Do_Args ../src/core/c-do.c:668
    #33 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #34 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #35 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #36 0x419332 in Do_Next ../src/core/c-do.c:886
    #37 0x4168bd in Do_Args ../src/core/c-do.c:668
    #38 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #39 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #40 0x4a6c9a in N_do ../src/core/n-control.c:524
    #41 0x43e037 in Do_Native ../src/core/c-function.c:289
    #42 0x419332 in Do_Next ../src/core/c-do.c:886
    #43 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #44 0x4a732e in N_either ../src/core/n-control.c:598
    #45 0x43e037 in Do_Native ../src/core/c-function.c:289
    #46 0x419332 in Do_Next ../src/core/c-do.c:886
    #47 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #48 0x4a732e in N_either ../src/core/n-control.c:598
    #49 0x43e037 in Do_Native ../src/core/c-function.c:289
    #50 0x419332 in Do_Next ../src/core/c-do.c:886
    #51 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #52 0x4a732e in N_either ../src/core/n-control.c:598
    #53 0x43e037 in Do_Native ../src/core/c-function.c:289
    #54 0x419332 in Do_Next ../src/core/c-do.c:886
    #55 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #56 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #57 0x42094d in Apply_Function ../src/core/c-do.c:1528
    #58 0x42116c in Do_Sys_Func ../src/core/c-do.c:1588
    #59 0x426d54 in Init_Mezz ../src/core/c-do.c:2320
    #60 0x4069c1 in RL_Start ../src/core/a-lib.c:193
    #61 0x5fea9d in main ../src/os/host-main.c:235
    #62 0x7f011fed27ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #63 0x405dd8 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x405dd8)

0x6030000add40 is located 0 bytes inside of 24-byte region [0x6030000add40,0x6030000add58)
allocated by thread T0 here:
    #0 0x7f01219457a7 in malloc (/usr/lib/libasan.so.1+0x577a7)
    #1 0x606495 in OS_Make ../src/os/linux/host-lib.c:380
    #2 0x664b61 in RXD_Draw ../src/os/host-draw.c:438
    #3 0x472f24 in Do_Commands ../src/core/f-extension.c:585
    #4 0x4073a0 in RL_Do_Commands ../src/core/a-lib.c:402
    #5 0x66fadb in rebdrw_gob_draw ../src/os/host-draw-api-agg.cpp:568
    #6 0x678500 in process_gobs ../src/os/linux/host-compositor.c:520
    #7 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #8 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #9 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #10 0x67b63f in rebcmp_compose ../src/os/linux/host-compositor.c:685
    #11 0x65158c in Draw_Window ../src/os/host-view.c:225
    #12 0x651b21 in Show_Gob ../src/os/host-view.c:288
    #13 0x6520ed in RXD_Graphics ../src/os/host-view.c:346
    #14 0x471ccd in Do_Command ../src/core/f-extension.c:456
    #15 0x419332 in Do_Next ../src/core/c-do.c:886
    #16 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #17 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #18 0x419332 in Do_Next ../src/core/c-do.c:886
    #19 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #20 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #21 0x419332 in Do_Next ../src/core/c-do.c:886
    #22 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #23 0x4a6c9a in N_do ../src/core/n-control.c:524
    #24 0x43e037 in Do_Native ../src/core/c-function.c:289
    #25 0x419332 in Do_Next ../src/core/c-do.c:886
    #26 0x41b643 in Try_Block ../src/core/c-do.c:1087
    #27 0x4a872e in N_try ../src/core/n-control.c:760
    #28 0x43e037 in Do_Native ../src/core/c-function.c:289
    #29 0x419332 in Do_Next ../src/core/c-do.c:886

SUMMARY: AddressSanitizer: alloc-dealloc-mismatch ??:0 operator delete[](void*)
==32465==HINT: if you don't care about these warnings you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==32465==ABORTING
37618cc
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Remove free'd serieses from GC_Infants
reported by address sanitizer with manual poisonation:

=================================================================
==11513==ERROR: AddressSanitizer: use-after-poison on address 0x7efe281542c0 at pc 0x00000071038f bp 0x7ffdc9de9330 sp 0x7ffdc9de9328
READ of size 4 at 0x7efe281542c0 thread T0
    #0 0x71038e in Mark_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501:6
    #1 0x70ea8b in Recycle /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:744:4
    #2 0x7bbde6 in N_recycle /home/zsx/stuffs/work/r3.git/make/../src/core/n-system.c:99:10
    #3 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #4 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #5 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #6 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #7 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #8 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #9 0xb0b6d9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #10 0xb0e7f7 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #11 0xb07b10 in Parse_Series /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:96:9
    #12 0xb06b65 in N_parse /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:1269:7
    #13 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #14 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #19 0x745e54 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #20 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #21 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #22 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #23 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #24 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #25 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #26 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #27 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #28 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #29 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #30 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #31 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #32 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #33 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #34 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #35 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #36 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #37 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #38 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #39 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #40 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #41 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #42 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #43 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #44 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #45 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #46 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #47 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #48 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #49 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #50 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #51 0x582548 in Init_Mezz /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:2320:9
    #52 0x52e62f in RL_Start /home/zsx/stuffs/work/r3.git/make/../src/core/a-lib.c:193:9
    #53 0xbb6c93 in main /home/zsx/stuffs/work/r3.git/make/../src/os/host-main.c:235:6
    #54 0x7efe2bfcb7ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #55 0x486498 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x486498)

0x7efe281542c0 is located 96960 bytes inside of 131088-byte region [0x7efe2813c800,0x7efe2815c810)
allocated by thread T0 here:
    #0 0x50d462 in __interceptor_malloc (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x50d462)
    #1 0x721a85 in Make_Mem /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:127:14
    #2 0x723acd in Fill_Pool /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:235:19
    #3 0x7233af in Make_Node /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:280:20
    #4 0x725f8a in Make_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:391:21
    #5 0x738823 in Copy_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-series.c:261:19
    #6 0x5f93a6 in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:131:22
    #7 0x5f98cf in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:136:6
    #8 0x5fa3ed in Copy_Block_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:159:18
    #9 0x89efc2 in T_Block /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:796:23
    #10 0x5c458f in Do_Act /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:338:8
    #11 0x5c5927 in Do_Action /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:396:2
    #12 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #13 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #14 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #19 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #20 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #21 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #22 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #23 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #24 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #25 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #26 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #27 0x5a37d0 in Make_Module /home/zsx/stuffs/work/r3.git/make/../src/core/c-frame.c:585:10
    #28 0x9510d5 in T_Object /home/zsx/stuffs/work/r3.git/make/../src/core/t-object.c:308:16
    #29 0x8ac4eb in T_Datatype /home/zsx/stuffs/work/r3.git/make/../src/core/t-datatype.c:92:20

SUMMARY: AddressSanitizer: use-after-poison /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501 Mark_Series
Shadow bytes around the buggy address:
  0x0fe045022800: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
  0x0fe045022810: 00 00 00 00 00 00 f7 f7 f7 f7 00 00 00 00 00 00
  0x0fe045022820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022830: 00 00 f7 f7 f7 f7 00 00 00 00 00 00 00 00 f7 f7
  0x0fe045022840: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
=>0x0fe045022850: 00 00 00 00 00 00 f7 f7[f7]f7 00 00 00 00 00 00
  0x0fe045022860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0450228a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11513==ABORTING
ba08071
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Pass correct length to Deline_*
The length of the VAL_SERIES(value) has been set correctly by
Append_UTF8, and it could be smaller than "len", because UTF8 is a
multi-byte encoding, thus passing "len" to Deline_Uni could cause
out-of-bound memory access.

Fixes CC#2169

The following code

    REBOL[]
    t: <ēee>

causes:

==13053==ERROR: AddressSanitizer: use-after-poison on address 0x61d00001a5f8 at pc 0x000000853d50 bp 0x7ffd2a31a1b0 sp 0x7ffd2a31a1a8
WRITE of size 2 at 0x61d00001a5f8 thread T0
    #0 0x853d4f in Deline_Uni /home/zsx/stuffs/work/r3.git/make/../src/core/s-ops.c:426:2
    #1 0x7064d4 in Scan_Any /home/zsx/stuffs/work/r3.git/make/../src/core/l-types.c:846:7
    #2 0x6dca3c in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1421:4
    #3 0x6d9f92 in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1301:12
    #4 0x6df0e6 in Scan_Code /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1550:9
    #5 0x6df462 in Scan_Source /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1570:9
    #6 0x896105 in Make_Block_Type /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:306:9
    #7 0x89af62 in T_Block /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:624:3
    #8 0x8ac80b in T_Datatype /home/zsx/stuffs/work/r3.git/make/../src/core/t-datatype.c:92:20
    #9 0x5c458f in Do_Act /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:338:8
    #10 0x5c5927 in Do_Action /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:396:2
    #11 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #12 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #13 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #14 0x746174 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #15 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #16 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #17 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #18 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #19 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #20 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #21 0x568295 in Try_Block /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1087:11
    #22 0x7506ac in N_try /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:760:6
    #23 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #24 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #25 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #26 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #27 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #28 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #29 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #30 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #31 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #32 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #33 0xb0b9f9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #34 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #35 0xb07e30 in Parse_Series /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:96:9
    #36 0xb06e85 in N_parse /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:1269:7
    #37 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #38 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #39 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #40 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #41 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #42 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #43 0x746174 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #44 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #45 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #46 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #47 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #48 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #49 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #50 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #51 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #52 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #53 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #54 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #55 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #56 0x749e2b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #57 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #58 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #59 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #60 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #61 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #62 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #63 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #64 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #65 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #66 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #67 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #68 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #69 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #70 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #71 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #72 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #73 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #74 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #75 0x582548 in Init_Mezz /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:2320:9
    #76 0x52e62f in RL_Start /home/zsx/stuffs/work/r3.git/make/../src/core/a-lib.c:193:9
    #77 0xbb6fb3 in main /home/zsx/stuffs/work/r3.git/make/../src/os/host-main.c:235:6
    #78 0x7fd1c04ef7ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #79 0x486498 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x486498)

0x61d00001a5f8 is located 376 bytes inside of 2064-byte region [0x61d00001a480,0x61d00001ac90)
allocated by thread T0 here:
    #0 0x50d462 in __interceptor_malloc (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x50d462)
    #1 0x721a85 in Make_Mem /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:132:14
    #2 0x723bed in Fill_Pool /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:240:19
    #3 0x7233c2 in Make_Node /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:295:20
    #4 0x7267f3 in Make_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:419:10
    #5 0x818d71 in Copy_String /home/zsx/stuffs/work/r3.git/make/../src/core/s-make.c:337:8
    #6 0x6dc386 in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1388:22
    #7 0x6df0e6 in Scan_Code /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1550:9
    #8 0x6e1f81 in N_transcode /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1630:8
    #9 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #10 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #11 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #12 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #13 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #14 0x56110f in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:942:13
    #15 0x568295 in Try_Block /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1087:11
    #16 0x7506ac in N_try /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:760:6
    #17 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #18 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #19 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #20 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #21 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #22 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #23 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #24 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #25 0xb0b9f9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #26 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #27 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #28 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #29 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9

SUMMARY: AddressSanitizer: use-after-poison /home/zsx/stuffs/work/r3.git/make/../src/core/s-ops.c:426 Deline_Uni
Shadow bytes around the buggy address:
  0x0c3a7fffb460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb490: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c3a7fffb4b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 f7 00 00[f7]
  0x0c3a7fffb4c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb500: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==13053==ABORTING
6c131c1
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Do not increase tail before extension
It will confuse Expand_Series expects "tail" to be the actual size, and
cause a read beyond the allocated memory, or heap buffer overflow found
by address sanitizer of GCC:
=================================================================
==10856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00000b201 at pc 0x47df61 bp 0x7fffffff2ca0 sp 0x7fffffff2c98
READ of size 1 at 0x62a00000b201 thread T0
    #0 0x47df60 in Expand_Series ../src/core/m-series.c:145
    #1 0x47e5a7 in Extend_Series ../src/core/m-series.c:187
    #2 0x466e0c in Scan_Quote ../src/core/l-scan.c:462
    #3 0x46a797 in Scan_Token ../src/core/l-scan.c:918
    #4 0x46e263 in Scan_Block ../src/core/l-scan.c:1188
    #5 0x46e722 in Scan_Code ../src/core/l-scan.c:1548
    #6 0x46e886 in Scan_Source ../src/core/l-scan.c:1568
    #7 0x4cb85c in Make_Block_Type ../src/core/t-block.c:306
    #8 0x4cd1b8 in T_Block ../src/core/t-block.c:608
    #9 0x4d042e in T_Datatype ../src/core/t-datatype.c:92
    #10 0x42e080 in Do_Act ../src/core/c-function.c:338
    #11 0x42e7e5 in Do_Action ../src/core/c-function.c:396
    #12 0x413628 in Do_Next ../src/core/c-do.c:884
    #13 0x41309b in Do_Next ../src/core/c-do.c:858
    #14 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #15 0x482dd2 in N_case ../src/core/n-control.c:349
    #16 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #17 0x413628 in Do_Next ../src/core/c-do.c:884
    #18 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #19 0x42e869 in Do_Function ../src/core/c-function.c:415
    #20 0x413628 in Do_Next ../src/core/c-do.c:884
    #21 0x41309b in Do_Next ../src/core/c-do.c:858
    #22 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #23 0x42e869 in Do_Function ../src/core/c-function.c:415
    #24 0x413628 in Do_Next ../src/core/c-do.c:884
    #25 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #26 0x414152 in Do_Next ../src/core/c-do.c:939
    #27 0x48201c in N_all ../src/core/n-control.c:261
    #28 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #29 0x413628 in Do_Next ../src/core/c-do.c:884
    #30 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #31 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #32 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #33 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #34 0x413628 in Do_Next ../src/core/c-do.c:884
    #35 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #36 0x42e869 in Do_Function ../src/core/c-function.c:415
    #37 0x413628 in Do_Next ../src/core/c-do.c:884
    #38 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #39 0x414152 in Do_Next ../src/core/c-do.c:939
    #40 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #41 0x48459c in N_if ../src/core/n-control.c:619
    #42 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #43 0x413628 in Do_Next ../src/core/c-do.c:884
    #44 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #45 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #46 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #47 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #48 0x413628 in Do_Next ../src/core/c-do.c:884
    #49 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #50 0x42e869 in Do_Function ../src/core/c-function.c:415
    #51 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #52 0x4824fb in N_apply ../src/core/n-control.c:295
    #53 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #54 0x413628 in Do_Next ../src/core/c-do.c:884
    #55 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #56 0x414152 in Do_Next ../src/core/c-do.c:939
    #57 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #58 0x485388 in N_unless ../src/core/n-control.c:763
    #59 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #60 0x413628 in Do_Next ../src/core/c-do.c:884
    #61 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #62 0x483eff in N_do ../src/core/n-control.c:523
    #63 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #64 0x413628 in Do_Next ../src/core/c-do.c:884
    #65 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #66 0x414152 in Do_Next ../src/core/c-do.c:939
    #67 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #68 0x48459c in N_if ../src/core/n-control.c:619
    #69 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #70 0x413628 in Do_Next ../src/core/c-do.c:884
    #71 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #72 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #73 0x49314d in N_repeat ../src/core/n-loop.c:631
    #74 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #75 0x413628 in Do_Next ../src/core/c-do.c:884
    #76 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #77 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #78 0x413628 in Do_Next ../src/core/c-do.c:884
    #79 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #80 0x485388 in N_unless ../src/core/n-control.c:763
    #81 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #82 0x413628 in Do_Next ../src/core/c-do.c:884
    #83 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #84 0x42e869 in Do_Function ../src/core/c-function.c:415
    #85 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #86 0x4824fb in N_apply ../src/core/n-control.c:295
    #87 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #88 0x413628 in Do_Next ../src/core/c-do.c:884
    #89 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #90 0x414152 in Do_Next ../src/core/c-do.c:939
    #91 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #92 0x485388 in N_unless ../src/core/n-control.c:763
    #93 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #94 0x413628 in Do_Next ../src/core/c-do.c:884
    #95 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #96 0x483eff in N_do ../src/core/n-control.c:523
    #97 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #98 0x413628 in Do_Next ../src/core/c-do.c:884
    #99 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #100 0x414152 in Do_Next ../src/core/c-do.c:939
    #101 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #102 0x48459c in N_if ../src/core/n-control.c:619
    #103 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #104 0x413628 in Do_Next ../src/core/c-do.c:884
    #105 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #106 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #107 0x49314d in N_repeat ../src/core/n-loop.c:631
    #108 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #109 0x413628 in Do_Next ../src/core/c-do.c:884
    #110 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #111 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #112 0x413628 in Do_Next ../src/core/c-do.c:884
    #113 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #114 0x485388 in N_unless ../src/core/n-control.c:763
    #115 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #116 0x413628 in Do_Next ../src/core/c-do.c:884
    #117 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #118 0x42e869 in Do_Function ../src/core/c-function.c:415
    #119 0x413628 in Do_Next ../src/core/c-do.c:884
    #120 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #121 0x484cf1 in N_switch ../src/core/n-control.c:716
    #122 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #123 0x413628 in Do_Next ../src/core/c-do.c:884
    #124 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #125 0x42e869 in Do_Function ../src/core/c-function.c:415
    #126 0x413628 in Do_Next ../src/core/c-do.c:884
    #127 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #128 0x48459c in N_if ../src/core/n-control.c:619
    #129 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #130 0x413628 in Do_Next ../src/core/c-do.c:884
    #131 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #132 0x42e869 in Do_Function ../src/core/c-function.c:415
    #133 0x413628 in Do_Next ../src/core/c-do.c:884
    #134 0x41309b in Do_Next ../src/core/c-do.c:858
    #135 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #136 0x484280 in N_either ../src/core/n-control.c:595
    #137 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #138 0x413628 in Do_Next ../src/core/c-do.c:884
    #139 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #140 0x42e869 in Do_Function ../src/core/c-function.c:415
    #141 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #142 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #143 0x48d102 in N_wake_up ../src/core/n-io.c:415
    #144 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #145 0x413628 in Do_Next ../src/core/c-do.c:884
    #146 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #147 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #148 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #149 0x492b66 in N_loop ../src/core/n-loop.c:590
    #150 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #151 0x413628 in Do_Next ../src/core/c-do.c:884
    #152 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #153 0x42e869 in Do_Function ../src/core/c-function.c:415
    #154 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #155 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #156 0x42fef7 in Awake_System ../src/core/c-port.c:198
    #157 0x43012a in Wait_Ports ../src/core/c-port.c:231
    #158 0x48cd62 in N_wait ../src/core/n-io.c:374
    #159 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #160 0x413628 in Do_Next ../src/core/c-do.c:884
    #161 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #162 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #163 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #164 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #165 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #166 0x4929a7 in N_forever ../src/core/n-loop.c:527
    #167 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #168 0x413628 in Do_Next ../src/core/c-do.c:884
    #169 0x4152ff in Try_Block ../src/core/c-do.c:1077
    #170 0x48507e in N_try ../src/core/n-control.c:740
    #171 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #172 0x413628 in Do_Next ../src/core/c-do.c:884
    #173 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #174 0x414152 in Do_Next ../src/core/c-do.c:939
    #175 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #176 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #177 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #178 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #179 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #180 0x42e869 in Do_Function ../src/core/c-function.c:415
    #181 0x413628 in Do_Next ../src/core/c-do.c:884
    #182 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #183 0x48459c in N_if ../src/core/n-control.c:619
    #184 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #185 0x413628 in Do_Next ../src/core/c-do.c:884
    #186 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #187 0x42e869 in Do_Function ../src/core/c-function.c:415
    #188 0x413628 in Do_Next ../src/core/c-do.c:884
    #189 0x41309b in Do_Next ../src/core/c-do.c:858
    #190 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #191 0x42e869 in Do_Function ../src/core/c-function.c:415
    #192 0x413628 in Do_Next ../src/core/c-do.c:884
    #193 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #194 0x42e869 in Do_Function ../src/core/c-function.c:415
    #195 0x413628 in Do_Next ../src/core/c-do.c:884
    #196 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #197 0x414152 in Do_Next ../src/core/c-do.c:939
    #198 0x48201c in N_all ../src/core/n-control.c:261
    #199 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #200 0x413628 in Do_Next ../src/core/c-do.c:884
    #201 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #202 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #203 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #204 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #205 0x413628 in Do_Next ../src/core/c-do.c:884
    #206 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #207 0x42e869 in Do_Function ../src/core/c-function.c:415
    #208 0x413628 in Do_Next ../src/core/c-do.c:884
    #209 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #210 0x485388 in N_unless ../src/core/n-control.c:763
    #211 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #212 0x413628 in Do_Next ../src/core/c-do.c:884
    #213 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #214 0x42e869 in Do_Function ../src/core/c-function.c:415
    #215 0x413628 in Do_Next ../src/core/c-do.c:884
    #216 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #217 0x48459c in N_if ../src/core/n-control.c:619
    #218 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #219 0x413628 in Do_Next ../src/core/c-do.c:884
    #220 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #221 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #222 0x413628 in Do_Next ../src/core/c-do.c:884
    #223 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #224 0x414152 in Do_Next ../src/core/c-do.c:939
    #225 0x48201c in N_all ../src/core/n-control.c:261
    #226 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #227 0x413628 in Do_Next ../src/core/c-do.c:884
    #228 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #229 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #230 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #231 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #232 0x413628 in Do_Next ../src/core/c-do.c:884
    #233 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #234 0x42e869 in Do_Function ../src/core/c-function.c:415
    #235 0x413628 in Do_Next ../src/core/c-do.c:884
    #236 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #237 0x48459c in N_if ../src/core/n-control.c:619
    #238 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #239 0x413628 in Do_Next ../src/core/c-do.c:884
    #240 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #241 0x42e869 in Do_Function ../src/core/c-function.c:415
    #242 0x413628 in Do_Next ../src/core/c-do.c:884
    #243 0x41309b in Do_Next ../src/core/c-do.c:858
    #244 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #245 0x42e869 in Do_Function ../src/core/c-function.c:415
    #246 0x413628 in Do_Next ../src/core/c-do.c:884
    #247 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #248 0x48459c in N_if ../src/core/n-control.c:619
    #249 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #250 0x413628 in Do_Next ../src/core/c-do.c:884
    #251 0x414825 in Do_Blk ../src/core/c-do.c:1010

0x62a00000b201 is located 1 bytes to the right of 20480-byte region [0x62a000006200,0x62a00000b200)
allocated by thread T0 here:
    #0 0x7ffff6f58b1f in malloc (/usr/lib/libasan.so.1+0x54b1f)
    #1 0x47924a in Make_Mem ../src/core/m-pools.c:121
    #2 0x47a9ff in Make_Series ../src/core/m-pools.c:406
    #3 0x4aee84 in Make_Unicode ../src/core/s-make.c:59
    #4 0x4bb797 in Init_Mold ../src/core/s-mold.c:1425
    #5 0x40da64 in Init_Core ../src/core/b-init.c:940
    #6 0x4055e0 in RL_Init ../src/core/a-lib.c:124
    #7 0x580aa2 in main ../src/os/host-main.c:154
    #8 0x7ffff5719fff in __libc_start_main (/usr/lib/libc.so.6+0x1ffff)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:145 Expand_Series
Shadow bytes around the buggy address:
  0x0c547fff95f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c547fff9640:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:
84c101d
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Fix a heap-buffer-overflow
Found by AddressSanitizer:
==8157==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d0000f5897 at pc 0x4816ef bp 0x7fffffffafb0 sp 0x7fffffffafa0
READ of size 1 at 0x61d0000f5897 thread T0
    #0 0x4816ee in Expand_Series ../src/core/m-series.c:138
    #1 0x4e258c in Insert_Gobs ../src/core/t-gob.c:219
    #2 0x4e7782 in T_Gob ../src/core/t-gob.c:833
    #3 0x42e26f in Do_Act ../src/core/c-function.c:338
    #4 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #5 0x41395b in Do_Next ../src/core/c-do.c:886
    #6 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #7 0x4883d6 in N_if ../src/core/n-control.c:632
    #8 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #9 0x41395b in Do_Next ../src/core/c-do.c:886
    #10 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #11 0x4893c0 in N_unless ../src/core/n-control.c:792
    #12 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #13 0x41395b in Do_Next ../src/core/c-do.c:886
    #14 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #15 0x488c03 in N_switch ../src/core/n-control.c:736
    #16 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #17 0x41395b in Do_Next ../src/core/c-do.c:886
    #18 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #19 0x4883d6 in N_if ../src/core/n-control.c:632
    #20 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #21 0x41395b in Do_Next ../src/core/c-do.c:886
    #22 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #23 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #24 0x41395b in Do_Next ../src/core/c-do.c:886
    #25 0x415658 in Try_Block ../src/core/c-do.c:1083
    #26 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #27 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #28 0x41395b in Do_Next ../src/core/c-do.c:886
    #29 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #30 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #31 0x49693a in N_for ../src/core/n-loop.c:486
    #32 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #33 0x41395b in Do_Next ../src/core/c-do.c:886
    #34 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #35 0x4883d6 in N_if ../src/core/n-control.c:632
    #36 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #37 0x41395b in Do_Next ../src/core/c-do.c:886
    #38 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #39 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #40 0x41395b in Do_Next ../src/core/c-do.c:886
    #41 0x415658 in Try_Block ../src/core/c-do.c:1083
    #42 0x488f7d in N_try ../src/core/n-control.c:760
    #43 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #44 0x41395b in Do_Next ../src/core/c-do.c:886
    #45 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #46 0x413700 in Do_Next ../src/core/c-do.c:879
    #47 0x4118a1 in Do_Args ../src/core/c-do.c:668
    #48 0x413700 in Do_Next ../src/core/c-do.c:879
    #49 0x414f2f in Do_Block_Value_Throw ../src/core/c-do.c:1048
    #50 0x5725ac in Parse_Rules_Loop ../src/core/u-parse.c:830
    #51 0x5731f8 in Parse_Rules_Loop ../src/core/u-parse.c:927
    #52 0x56c799 in Parse_Series ../src/core/u-parse.c:96
    #53 0x576950 in N_parse ../src/core/u-parse.c:1269
    #54 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #55 0x41395b in Do_Next ../src/core/c-do.c:886
    #56 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #57 0x4883d6 in N_if ../src/core/n-control.c:632
    #58 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #59 0x41395b in Do_Next ../src/core/c-do.c:886
    #60 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #61 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #62 0x41395b in Do_Next ../src/core/c-do.c:886
    #63 0x415658 in Try_Block ../src/core/c-do.c:1083
    #64 0x4862f8 in N_attempt ../src/core/n-control.c:306
    #65 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #66 0x41395b in Do_Next ../src/core/c-do.c:886
    #67 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #68 0x487b91 in N_do ../src/core/n-control.c:524
    #69 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #70 0x41395b in Do_Next ../src/core/c-do.c:886
    #71 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #72 0x487fcb in N_either ../src/core/n-control.c:598
    #73 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #74 0x41395b in Do_Next ../src/core/c-do.c:886
    #75 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #76 0x487fcb in N_either ../src/core/n-control.c:598
    #77 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #78 0x41395b in Do_Next ../src/core/c-do.c:886
    #79 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #80 0x487fcb in N_either ../src/core/n-control.c:598
    #81 0x42dd9c in Do_Native ../src/core/c-function.c:289
    #82 0x41395b in Do_Next ../src/core/c-do.c:886
    #83 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #84 0x42ea5c in Do_Function ../src/core/c-function.c:415
    #85 0x4198c2 in Apply_Function ../src/core/c-do.c:1524
    #86 0x419fa8 in Do_Sys_Func ../src/core/c-do.c:1584
    #87 0x41e406 in Init_Mezz ../src/core/c-do.c:2313
    #88 0x405fd3 in RL_Start ../src/core/a-lib.c:167
    #89 0x59d1f7 in main ../src/os/host-main.c:231
    #90 0x7ffff571403f in __libc_start_main (/usr/lib/libc.so.6+0x2003f)
    #91 0x405858 (/home/zsx/work/r3.git/make/r3-view-linux+0x405858)

0x61d0000f5897 is located 7 bytes to the right of 2064-byte region [0x61d0000f5080,0x61d0000f5890)
allocated by thread T0 here:
    #0 0x7ffff6f56b77 in __interceptor_malloc (/usr/lib/libasan.so.1+0x57b77)
    #1 0x47c300 in Make_Mem ../src/core/m-pools.c:125
    #2 0x47ca2f in Fill_Pool ../src/core/m-pools.c:233
    #3 0x47d80c in Make_Series ../src/core/m-pools.c:388
    #4 0x4826f3 in Copy_Series ../src/core/m-series.c:261
    #5 0x43ca14 in Copy_Deep_Values ../src/core/f-blocks.c:131
    #6 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #7 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #8 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #9 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #10 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #11 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #12 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #13 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #14 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #15 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #16 0x43cb82 in Copy_Deep_Values ../src/core/f-blocks.c:136
    #17 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #18 0x43cd9f in Clone_Block ../src/core/f-blocks.c:174
    #19 0x42db12 in Clone_Function ../src/core/c-function.c:266
    #20 0x43cc00 in Copy_Deep_Values ../src/core/f-blocks.c:139
    #21 0x43cd30 in Copy_Block_Values ../src/core/f-blocks.c:159
    #22 0x4fd371 in T_Object ../src/core/t-object.c:364
    #23 0x42e26f in Do_Act ../src/core/c-function.c:338
    #24 0x42e9d8 in Do_Action ../src/core/c-function.c:396
    #25 0x41395b in Do_Next ../src/core/c-do.c:886
    #26 0x4133cc in Do_Next ../src/core/c-do.c:860
    #27 0x414b73 in Do_Blk ../src/core/c-do.c:1016
    #28 0x493bb9 in Loop_Integer ../src/core/n-loop.c:131
    #29 0x49693a in N_for ../src/core/n-loop.c:486

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:138 Expand_Series
Shadow bytes around the buggy address:
  0x0c3a80016ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a80016b10: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80016b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80016b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==8157==ABORTING

This is happening because "GOB_TAIL(gob) = count" sets the tail of a
series with length of "count" to be "count", and Expand_Series expects
a terminator in the series. (m-series.c:90 size  = (series->tail + 1) * wide;)
21dae6b
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Fix an alloc-dealloc-mismatch
Found by GCC Address Sanitizer:

=================================================================
==32465==ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete []) on 0x6030000add40
    #0 0x7f012194676f in operator delete[](void*) (/usr/lib/libasan.so.1+0x5876f)
    #1 0x6c8785 in agg::agg_graphics::agg_reset() ../src/agg/agg_graphics.cpp:1562
    #2 0x6bc20c in agg::agg_graphics::~agg_graphics() ../src/agg/agg_graphics.cpp:96
    #3 0x66fb18 in rebdrw_gob_draw ../src/os/host-draw-api-agg.cpp:571
    #4 0x678500 in process_gobs ../src/os/linux/host-compositor.c:520
    #5 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #6 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #7 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #8 0x67b63f in rebcmp_compose ../src/os/linux/host-compositor.c:685
    #9 0x65158c in Draw_Window ../src/os/host-view.c:225
    #10 0x651b21 in Show_Gob ../src/os/host-view.c:288
    #11 0x6520ed in RXD_Graphics ../src/os/host-view.c:346
    #12 0x471ccd in Do_Command ../src/core/f-extension.c:456
    #13 0x419332 in Do_Next ../src/core/c-do.c:886
    #14 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #15 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #16 0x419332 in Do_Next ../src/core/c-do.c:886
    #17 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #18 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #19 0x419332 in Do_Next ../src/core/c-do.c:886
    #20 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #21 0x4a6c9a in N_do ../src/core/n-control.c:524
    #22 0x43e037 in Do_Native ../src/core/c-function.c:289
    #23 0x419332 in Do_Next ../src/core/c-do.c:886
    #24 0x41b643 in Try_Block ../src/core/c-do.c:1087
    #25 0x4a872e in N_try ../src/core/n-control.c:760
    #26 0x43e037 in Do_Native ../src/core/c-function.c:289
    #27 0x419332 in Do_Next ../src/core/c-do.c:886
    #28 0x4168bd in Do_Args ../src/core/c-do.c:668
    #29 0x41a070 in Do_Next ../src/core/c-do.c:942
    #30 0x4168bd in Do_Args ../src/core/c-do.c:668
    #31 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #32 0x4168bd in Do_Args ../src/core/c-do.c:668
    #33 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #34 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #35 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #36 0x419332 in Do_Next ../src/core/c-do.c:886
    #37 0x4168bd in Do_Args ../src/core/c-do.c:668
    #38 0x4190d4 in Do_Next ../src/core/c-do.c:879
    #39 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #40 0x4a6c9a in N_do ../src/core/n-control.c:524
    #41 0x43e037 in Do_Native ../src/core/c-function.c:289
    #42 0x419332 in Do_Next ../src/core/c-do.c:886
    #43 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #44 0x4a732e in N_either ../src/core/n-control.c:598
    #45 0x43e037 in Do_Native ../src/core/c-function.c:289
    #46 0x419332 in Do_Next ../src/core/c-do.c:886
    #47 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #48 0x4a732e in N_either ../src/core/n-control.c:598
    #49 0x43e037 in Do_Native ../src/core/c-function.c:289
    #50 0x419332 in Do_Next ../src/core/c-do.c:886
    #51 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #52 0x4a732e in N_either ../src/core/n-control.c:598
    #53 0x43e037 in Do_Native ../src/core/c-function.c:289
    #54 0x419332 in Do_Next ../src/core/c-do.c:886
    #55 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #56 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #57 0x42094d in Apply_Function ../src/core/c-do.c:1528
    #58 0x42116c in Do_Sys_Func ../src/core/c-do.c:1588
    #59 0x426d54 in Init_Mezz ../src/core/c-do.c:2320
    #60 0x4069c1 in RL_Start ../src/core/a-lib.c:193
    #61 0x5fea9d in main ../src/os/host-main.c:235
    #62 0x7f011fed27ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #63 0x405dd8 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x405dd8)

0x6030000add40 is located 0 bytes inside of 24-byte region [0x6030000add40,0x6030000add58)
allocated by thread T0 here:
    #0 0x7f01219457a7 in malloc (/usr/lib/libasan.so.1+0x577a7)
    #1 0x606495 in OS_Make ../src/os/linux/host-lib.c:380
    #2 0x664b61 in RXD_Draw ../src/os/host-draw.c:438
    #3 0x472f24 in Do_Commands ../src/core/f-extension.c:585
    #4 0x4073a0 in RL_Do_Commands ../src/core/a-lib.c:402
    #5 0x66fadb in rebdrw_gob_draw ../src/os/host-draw-api-agg.cpp:568
    #6 0x678500 in process_gobs ../src/os/linux/host-compositor.c:520
    #7 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #8 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #9 0x6789b7 in process_gobs ../src/os/linux/host-compositor.c:559
    #10 0x67b63f in rebcmp_compose ../src/os/linux/host-compositor.c:685
    #11 0x65158c in Draw_Window ../src/os/host-view.c:225
    #12 0x651b21 in Show_Gob ../src/os/host-view.c:288
    #13 0x6520ed in RXD_Graphics ../src/os/host-view.c:346
    #14 0x471ccd in Do_Command ../src/core/f-extension.c:456
    #15 0x419332 in Do_Next ../src/core/c-do.c:886
    #16 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #17 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #18 0x419332 in Do_Next ../src/core/c-do.c:886
    #19 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #20 0x43f6c8 in Do_Function ../src/core/c-function.c:415
    #21 0x419332 in Do_Next ../src/core/c-do.c:886
    #22 0x41aaed in Do_Blk ../src/core/c-do.c:1017
    #23 0x4a6c9a in N_do ../src/core/n-control.c:524
    #24 0x43e037 in Do_Native ../src/core/c-function.c:289
    #25 0x419332 in Do_Next ../src/core/c-do.c:886
    #26 0x41b643 in Try_Block ../src/core/c-do.c:1087
    #27 0x4a872e in N_try ../src/core/n-control.c:760
    #28 0x43e037 in Do_Native ../src/core/c-function.c:289
    #29 0x419332 in Do_Next ../src/core/c-do.c:886

SUMMARY: AddressSanitizer: alloc-dealloc-mismatch ??:0 operator delete[](void*)
==32465==HINT: if you don't care about these warnings you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==32465==ABORTING
9323829
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Remove free'd serieses from GC_Infants
reported by address sanitizer with manual poisonation:

=================================================================
==11513==ERROR: AddressSanitizer: use-after-poison on address 0x7efe281542c0 at pc 0x00000071038f bp 0x7ffdc9de9330 sp 0x7ffdc9de9328
READ of size 4 at 0x7efe281542c0 thread T0
    #0 0x71038e in Mark_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501:6
    #1 0x70ea8b in Recycle /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:744:4
    #2 0x7bbde6 in N_recycle /home/zsx/stuffs/work/r3.git/make/../src/core/n-system.c:99:10
    #3 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #4 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #5 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #6 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #7 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #8 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #9 0xb0b6d9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #10 0xb0e7f7 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #11 0xb07b10 in Parse_Series /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:96:9
    #12 0xb06b65 in N_parse /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:1269:7
    #13 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #14 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #19 0x745e54 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #20 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #21 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #22 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #23 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #24 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #25 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #26 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #27 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #28 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #29 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #30 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #31 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #32 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #33 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #34 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #35 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #36 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #37 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #38 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #39 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #40 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #41 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #42 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #43 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #44 0x74abca in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #45 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #46 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #47 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #48 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #49 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #50 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #51 0x582548 in Init_Mezz /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:2320:9
    #52 0x52e62f in RL_Start /home/zsx/stuffs/work/r3.git/make/../src/core/a-lib.c:193:9
    #53 0xbb6c93 in main /home/zsx/stuffs/work/r3.git/make/../src/os/host-main.c:235:6
    #54 0x7efe2bfcb7ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #55 0x486498 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x486498)

0x7efe281542c0 is located 96960 bytes inside of 131088-byte region [0x7efe2813c800,0x7efe2815c810)
allocated by thread T0 here:
    #0 0x50d462 in __interceptor_malloc (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x50d462)
    #1 0x721a85 in Make_Mem /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:127:14
    #2 0x723acd in Fill_Pool /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:235:19
    #3 0x7233af in Make_Node /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:280:20
    #4 0x725f8a in Make_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:391:21
    #5 0x738823 in Copy_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-series.c:261:19
    #6 0x5f93a6 in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:131:22
    #7 0x5f98cf in Copy_Deep_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:136:6
    #8 0x5fa3ed in Copy_Block_Values /home/zsx/stuffs/work/r3.git/make/../src/core/f-blocks.c:159:18
    #9 0x89efc2 in T_Block /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:796:23
    #10 0x5c458f in Do_Act /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:338:8
    #11 0x5c5927 in Do_Action /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:396:2
    #12 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #13 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #14 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #15 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #16 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #17 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #18 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #19 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #20 0x749b0b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #21 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #22 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #23 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #24 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #25 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #26 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #27 0x5a37d0 in Make_Module /home/zsx/stuffs/work/r3.git/make/../src/core/c-frame.c:585:10
    #28 0x9510d5 in T_Object /home/zsx/stuffs/work/r3.git/make/../src/core/t-object.c:308:16
    #29 0x8ac4eb in T_Datatype /home/zsx/stuffs/work/r3.git/make/../src/core/t-datatype.c:92:20

SUMMARY: AddressSanitizer: use-after-poison /home/zsx/stuffs/work/r3.git/make/../src/core/m-gc.c:501 Mark_Series
Shadow bytes around the buggy address:
  0x0fe045022800: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
  0x0fe045022810: 00 00 00 00 00 00 f7 f7 f7 f7 00 00 00 00 00 00
  0x0fe045022820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022830: 00 00 f7 f7 f7 f7 00 00 00 00 00 00 00 00 f7 f7
  0x0fe045022840: f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7 f7 00 00
=>0x0fe045022850: 00 00 00 00 00 00 f7 f7[f7]f7 00 00 00 00 00 00
  0x0fe045022860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe045022890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe0450228a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11513==ABORTING
d270d53
@zsx zsx referenced this issue in metaeducation/ren-c Jun 21, 2015
@zsx zsx Pass correct length to Deline_*
The length of the VAL_SERIES(value) has been set correctly by
Append_UTF8, and it could be smaller than "len", because UTF8 is a
multi-byte encoding, thus passing "len" to Deline_Uni could cause
out-of-bound memory access.

Fixes CC#2169

The following code

    REBOL[]
    t: <ēee>

causes:

==13053==ERROR: AddressSanitizer: use-after-poison on address 0x61d00001a5f8 at pc 0x000000853d50 bp 0x7ffd2a31a1b0 sp 0x7ffd2a31a1a8
WRITE of size 2 at 0x61d00001a5f8 thread T0
    #0 0x853d4f in Deline_Uni /home/zsx/stuffs/work/r3.git/make/../src/core/s-ops.c:426:2
    #1 0x7064d4 in Scan_Any /home/zsx/stuffs/work/r3.git/make/../src/core/l-types.c:846:7
    #2 0x6dca3c in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1421:4
    #3 0x6d9f92 in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1301:12
    #4 0x6df0e6 in Scan_Code /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1550:9
    #5 0x6df462 in Scan_Source /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1570:9
    #6 0x896105 in Make_Block_Type /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:306:9
    #7 0x89af62 in T_Block /home/zsx/stuffs/work/r3.git/make/../src/core/t-block.c:624:3
    #8 0x8ac80b in T_Datatype /home/zsx/stuffs/work/r3.git/make/../src/core/t-datatype.c:92:20
    #9 0x5c458f in Do_Act /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:338:8
    #10 0x5c5927 in Do_Action /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:396:2
    #11 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #12 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #13 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #14 0x746174 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #15 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #16 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #17 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #18 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #19 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #20 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #21 0x568295 in Try_Block /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1087:11
    #22 0x7506ac in N_try /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:760:6
    #23 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #24 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #25 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #26 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #27 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #28 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #29 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #30 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #31 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #32 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #33 0xb0b9f9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #34 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #35 0xb07e30 in Parse_Series /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:96:9
    #36 0xb06e85 in N_parse /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:1269:7
    #37 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #38 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #39 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #40 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #41 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #42 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #43 0x746174 in N_case /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:348:10
    #44 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #45 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #46 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #47 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #48 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #49 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #50 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #51 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #52 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #53 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #54 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #55 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #56 0x749e2b in N_do /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:524:8
    #57 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #58 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #59 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #60 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #61 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #62 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #63 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #64 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #65 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #66 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #67 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #68 0x74aeea in N_either /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:598:3
    #69 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #70 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #71 0x5576e1 in Do_Blk /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1017:11
    #72 0x5c5c4f in Do_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:415:11
    #73 0x5758b0 in Apply_Function /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1528:33
    #74 0x576ec0 in Do_Sys_Func /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1588:10
    #75 0x582548 in Init_Mezz /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:2320:9
    #76 0x52e62f in RL_Start /home/zsx/stuffs/work/r3.git/make/../src/core/a-lib.c:193:9
    #77 0xbb6fb3 in main /home/zsx/stuffs/work/r3.git/make/../src/os/host-main.c:235:6
    #78 0x7fd1c04ef7ff in __libc_start_main (/usr/lib/libc.so.6+0x207ff)
    #79 0x486498 in _start (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x486498)

0x61d00001a5f8 is located 376 bytes inside of 2064-byte region [0x61d00001a480,0x61d00001ac90)
allocated by thread T0 here:
    #0 0x50d462 in __interceptor_malloc (/home/zsx/stuffs/work/r3.git/make/r3-view-linux+0x50d462)
    #1 0x721a85 in Make_Mem /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:132:14
    #2 0x723bed in Fill_Pool /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:240:19
    #3 0x7233c2 in Make_Node /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:295:20
    #4 0x7267f3 in Make_Series /home/zsx/stuffs/work/r3.git/make/../src/core/m-pools.c:419:10
    #5 0x818d71 in Copy_String /home/zsx/stuffs/work/r3.git/make/../src/core/s-make.c:337:8
    #6 0x6dc386 in Scan_Block /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1388:22
    #7 0x6df0e6 in Scan_Code /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1550:9
    #8 0x6e1f81 in N_transcode /home/zsx/stuffs/work/r3.git/make/../src/core/l-scan.c:1630:8
    #9 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #10 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #11 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #12 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #13 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #14 0x56110f in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:942:13
    #15 0x568295 in Try_Block /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1087:11
    #16 0x7506ac in N_try /home/zsx/stuffs/work/r3.git/make/../src/core/n-control.c:760:6
    #17 0x5c379d in Do_Native /home/zsx/stuffs/work/r3.git/make/../src/core/c-function.c:289:6
    #18 0x55f3d7 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:886:18
    #19 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #20 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #21 0x56360b in Do_Args /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:668:12
    #22 0x55edc9 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:879:11
    #23 0x55e447 in Do_Next /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:860:11
    #24 0x566f3d in Do_Block_Value_Throw /home/zsx/stuffs/work/r3.git/make/../src/core/c-do.c:1049:11
    #25 0xb0b9f9 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:830:4
    #26 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #27 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #28 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9
    #29 0xb0eb17 in Parse_Rules_Loop /home/zsx/stuffs/work/r3.git/make/../src/core/u-parse.c:927:9

SUMMARY: AddressSanitizer: use-after-poison /home/zsx/stuffs/work/r3.git/make/../src/core/s-ops.c:426 Deline_Uni
Shadow bytes around the buggy address:
  0x0c3a7fffb460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb490: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c3a7fffb4b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 f7 00 00[f7]
  0x0c3a7fffb4c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb4f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a7fffb500: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==13053==ABORTING
0a98b69
@johnk- johnk- referenced this issue in johnk-/impexptest Sep 13, 2015
Open

Build 64-bit binaries and libraries of R3 #1785

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment