| ================================================================= |
| ==102004==ERROR: AddressSanitizer: heap-use-after-free on address 0x000000f259c0 at pc 0x0000009de9c1 bp 0x7ffdb340f360 sp 0x7ffdb340f358 |
| READ of size 1 at 0x000000f259c0 thread T0 |
| #0 0x9de9c0 in convert_to_8_asan(unsigned int, unsigned int) /tmp/skia/out/Release/../../src/codec/SkMasks.cpp:54:16 |
| #1 0x9dd67e in swizzle_mask24_to_n32_opaque(void*, unsigned char const*, int, SkMasks*, unsigned int, unsigned int) /tmp/skia/out/Release/../../src/codec/SkMaskSwizzler.cpp:93:23 |
| #2 0x9d82d6 in SkBmpMaskCodec::decodeRows(SkImageInfo const&, void*, unsigned long, SkCodec::Options const&) /tmp/skia/out/Release/../../src/codec/SkBmpMaskCodec.cpp:103:9 |
| #3 0x9d805a in SkBmpMaskCodec::onGetPixels(SkImageInfo const&, void*, unsigned long, SkCodec::Options const&, unsigned int*, int*, int*) /tmp/skia/out/Release/../../src/codec/SkBmpMaskCodec.cpp:53:16 |
| #4 0x9c1453 in SkCodec::getPixels(SkImageInfo const&, void*, unsigned long, SkCodec::Options const*, unsigned int*, int*) /tmp/skia/out/Release/../../src/codec/SkCodec.cpp:204:27 |
| #5 0x7245fb in fuzz_img(SkData*) /tmp/skia/out/Release/../../fuzz/fuzz.cpp:119:13 |
| #6 0x724052 in main /tmp/skia/out/Release/../../fuzz/fuzz.cpp:53:30 |
| #7 0x7fda10ae6ec4 in __libc_start_main /tmp/tmp.Htw1L27e9P/csu/libc-start.c:287 |
| #8 0x67bfcf in _start (/tmp/executables/skcodec/analyzer0/fuzz_asan_release+0x67bfcf) |
| |
| 0x000000f259c0 is located 32 bytes to the left of global variable 'MIN_SIZE' defined in '../../src/gpu/GrResourceProvider.cpp:102:31' (0xf259e0) of size 4 |
| 0x000000f259c0 is located 20 bytes to the right of global variable 'kPattern' defined in '../../src/gpu/GrResourceProvider.cpp:69:27' (0xf259a0) of size 12 |
| SUMMARY: AddressSanitizer: heap-use-after-free /tmp/skia/out/Release/../../src/codec/SkMasks.cpp:54 convert_to_8(unsigned int, unsigned int) |
| Shadow bytes around the buggy address: |
| 0x0000801dcae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 0x0000801dcaf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 0x0000801dcb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 0x0000801dcb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 0x0000801dcb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| =>0x0000801dcb30: 00 00 00 00 00 04 f9 f9[f9]f9 f9 f9 04 f9 f9 f9 |
| 0x0000801dcb40: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 |
| 0x0000801dcb50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 0x0000801dcb60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 0x0000801dcb70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 0x0000801dcb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| Shadow byte legend (one shadow byte represents 8 application bytes): |
| Addressable: 00 |
| Partially addressable: 01 02 03 04 05 06 07 |
| Heap left redzone: fa |
| Heap right redzone: fb |
| Freed heap region: fd |
| Stack left redzone: f1 |
| Stack mid redzone: f2 |
| Stack right redzone: f3 |
| Stack partial redzone: f4 |
| Stack after return: f5 |
| Stack use after scope: f8 |
| Global redzone: f9 |
| Global init order: f6 |
| Poisoned by user: f7 |
| Container overflow: fc |
| Array cookie: ac |
| Intra object redzone: bb |
| ASan internal: fe |
| Left alloca redzone: ca |
| Right alloca redzone: cb |
| ==102004==ABORTING |
