Use-after-free in Context.__eq__ via re-entrant ContextVar.set #142829
Description
What happened?
Re-entrant ContextVar.set during _PyHamt_Eq lets Context.__eq__ replace a context while hamt_iterator_next still walks the old HAMT nodes, leaving the iterator with freed storage and producing a use-after-free when comparing two Context instances.
Proof of Concept:
import contextvars
var = contextvars.ContextVar("v")
ctx1 = contextvars.Context()
ctx2 = contextvars.Context()
class Boom:
def __eq__(self, other):
ctx1.run(lambda: var.set(object()))
return True
ctx1.run(var.set, Boom())
ctx2.run(var.set, object())
ctx1 == ctx2Affected Versions:
| Python Version | Status | Exit Code |
|---|---|---|
Python 3.9.24+ (heads/3.9:111bbc15b26, Oct 27 2025, 21:34:13) |
ASAN | 1 |
Python 3.10.19+ (heads/3.10:014261980b1, Oct 27 2025, 21:19:00) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.11.14+ (heads/3.11:88f3f5b5f11, Oct 27 2025, 21:20:35) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.12.12+ (heads/3.12:8cb2092bd8c, Oct 27 2025, 21:27:07) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.13.9+ (heads/3.13:9c8eade20c6, Oct 27 2025, 21:28:49) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.14.0+ (heads/3.14:2e216728038, Oct 27 2025, 21:30:55) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Python 3.15.0a1+ (heads/main:f5394c257ce, Oct 27 2025, 21:32:37) [Clang 18.1.3 (1ubuntu1)] |
ASAN | 1 |
Vulnerable Code:
int
_PyHamt_Eq(PyHamtObject *v, PyHamtObject *w)
{
if (v == w) {
return 1;
}
if (v->h_count != w->h_count) {
return 0;
}
PyHamtIteratorState iter;
hamt_iter_t iter_res;
hamt_find_t find_res;
PyObject *v_key;
PyObject *v_val;
PyObject *w_val;
hamt_iterator_init(&iter, v->h_root);
do {
iter_res = hamt_iterator_next(&iter, &v_key, &v_val);
if (iter_res == I_ITEM) {
find_res = hamt_find(w, v_key, &w_val);
switch (find_res) {
case F_ERROR:
return -1;
case F_NOT_FOUND:
return 0;
case F_FOUND: {
// Bug: Enter the __eq__ method which can tear down the HAMT we’re iterating
int cmp = PyObject_RichCompareBool(v_val, w_val, Py_EQ);
if (cmp < 0) {
return -1;
}
if (cmp == 0) {
return 0;
}
}
}
}
} while (iter_res != I_END);
return 1;
}Sanitizer Output:
=================================================================
==1348779==ERROR: AddressSanitizer: heap-use-after-free on address 0x5060000cff98 at pc 0x5b670b71e4b3 bp 0x7ffca41ad830 sp 0x7ffca41ad828
READ of size 8 at 0x5060000cff98 thread T0
#0 0x5b670b71e4b2 in _Py_TYPE /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:277:20
#1 0x5b670b71e4b2 in Py_IS_TYPE /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:302:12
#2 0x5b670b71e4b2 in hamt_iterator_next /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2193:9
#3 0x5b670b71de0a in _PyHamt_Eq /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2341:20
#4 0x5b670b6c8393 in context_tp_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:565:15
#5 0x5b670b464817 in do_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1059:15
#6 0x5b670b464817 in PyObject_RichCompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1108:21
#7 0x5b670b65e386 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:4683:35
#8 0x5b670b6463bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#9 0x5b670b6463bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#10 0x5b670b6463bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21
#11 0x5b670b79d370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12
#12 0x5b670b79d370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19
#13 0x5b670b79743c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15
#14 0x5b670b79743c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13
#15 0x5b670b796b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15
#16 0x5b670b7fefe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15
#17 0x5b670b7fefe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15
#18 0x5b670b7fd99d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21
#19 0x5b670b7fd99d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5
#20 0x5b670b7fe451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12
#21 0x5b670b7fe5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12
#22 0x779d3a22a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#23 0x779d3a22a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#24 0x5b670b1ae104 in _start (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x1c7104) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
0x5060000cff98 is located 24 bytes inside of 64-byte region [0x5060000cff80,0x5060000cffc0)
freed by thread T0 here:
#0 0x5b670b248cba in free (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x261cba) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
#1 0x5b670b46ace1 in _Py_Dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:3200:5
#2 0x5b670b71edad in Py_DECREF /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/refcount.h:420:9
#3 0x5b670b71edad in hamt_tp_clear /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2606:5
#4 0x5b670b71edad in hamt_tp_dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2636:11
#5 0x5b670b46ace1 in _Py_Dealloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:3200:5
#6 0x5b670b6c71b6 in Py_DECREF /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/refcount.h:420:9
#7 0x5b670b6c71b6 in contextvar_set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:801:5
#8 0x5b670b6c71b6 in PyContextVar_Set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:367:9
#9 0x5b670b37ea3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#10 0x5b670b37ea3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12
#11 0x5b670b665837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35
#12 0x5b670b646a14 in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#13 0x5b670b646a14 in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#14 0x5b670b6c9b13 in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#15 0x5b670b6c9b13 in context_run /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:728:29
#16 0x5b670b37ea3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#17 0x5b670b37ea3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12
#18 0x5b670b665837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35
#19 0x5b670b646a14 in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#20 0x5b670b646a14 in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#21 0x5b670b4c4488 in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#22 0x5b670b4c4488 in vectorcall_unbound /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3034:12
#23 0x5b670b4c4488 in maybe_call_special_one_arg /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3176:15
#24 0x5b670b4effc0 in _PyObject_MaybeCallSpecialOneArg /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:3191:12
#25 0x5b670b4effc0 in slot_tp_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/typeobject.c:10736:21
#26 0x5b670b464817 in do_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1059:15
#27 0x5b670b464817 in PyObject_RichCompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1108:21
#28 0x5b670b464397 in PyObject_RichCompareBool /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1130:11
#29 0x5b670b71ddda in _PyHamt_Eq /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2352:31
#30 0x5b670b6c8393 in context_tp_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:565:15
#31 0x5b670b464817 in do_richcompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1059:15
#32 0x5b670b464817 in PyObject_RichCompare /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/object.c:1108:21
#33 0x5b670b65e386 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:4683:35
#34 0x5b670b6463bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#35 0x5b670b6463bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#36 0x5b670b6463bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21
#37 0x5b670b79d370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12
#38 0x5b670b79d370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19
#39 0x5b670b79743c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15
#40 0x5b670b79743c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13
#41 0x5b670b796b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15
#42 0x5b670b7fefe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15
#43 0x5b670b7fefe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15
#44 0x5b670b7fd99d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21
#45 0x5b670b7fd99d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5
#46 0x5b670b7fe451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12
#47 0x5b670b7fe5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12
#48 0x779d3a22a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#49 0x779d3a22a28a in __libc_start_main csu/../csu/libc-start.c:360:3
previously allocated by thread T0 here:
#0 0x5b670b248f53 in malloc (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x261f53) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
#1 0x5b670b7040f8 in _PyObject_MallocWithType /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_object_alloc.h:46:17
#2 0x5b670b7040f8 in gc_alloc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/gc.c:2343:17
#3 0x5b670b7040f8 in _PyObject_GC_NewVar /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/gc.c:2385:25
#4 0x5b670b71fbda in hamt_node_bitmap_new /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:508:12
#5 0x5b670b71fbda in hamt_node_bitmap_assoc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:874:38
#6 0x5b670b719f91 in _PyHamt_Assoc /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/hamt.c:2222:16
#7 0x5b670b6c7140 in contextvar_set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:795:30
#8 0x5b670b6c7140 in PyContextVar_Set /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:367:9
#9 0x5b670b6c9b13 in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#10 0x5b670b6c9b13 in context_run /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/context.c:728:29
#11 0x5b670b37ea3b in _PyObject_VectorcallTstate /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_call.h:169:11
#12 0x5b670b37ea3b in PyObject_Vectorcall /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Objects/call.c:327:12
#13 0x5b670b665837 in _PyEval_EvalFrameDefault /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/generated_cases.c.h:1620:35
#14 0x5b670b6463bb in _PyEval_EvalFrame /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/internal/pycore_ceval.h:121:16
#15 0x5b670b6463bb in _PyEval_Vector /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:2005:12
#16 0x5b670b6463bb in PyEval_EvalCode /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/ceval.c:888:21
#17 0x5b670b79d370 in run_eval_code_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1365:12
#18 0x5b670b79d370 in run_mod /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1459:19
#19 0x5b670b79743c in pyrun_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:1293:15
#20 0x5b670b79743c in _PyRun_SimpleFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:521:13
#21 0x5b670b796b05 in _PyRun_AnyFileObject /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Python/pythonrun.c:81:15
#22 0x5b670b7fefe5 in pymain_run_file_obj /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:410:15
#23 0x5b670b7fefe5 in pymain_run_file /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:429:15
#24 0x5b670b7fd99d in pymain_run_python /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:691:21
#25 0x5b670b7fd99d in Py_RunMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:772:5
#26 0x5b670b7fe451 in pymain_main /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:802:12
#27 0x5b670b7fe5c3 in Py_BytesMain /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/Modules/main.c:826:12
#28 0x779d3a22a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#29 0x779d3a22a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#30 0x5b670b1ae104 in _start (/home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/python+0x1c7104) (BuildId: 5de9d2fcbcd44bfc1b0fe256566d49ad35ca1d56)
SUMMARY: AddressSanitizer: heap-use-after-free /home/jackfromeast/Desktop/entropy/tasks/reproducexx/targets/cpython-main/./Include/object.h:277:20 in _Py_TYPE
Shadow bytes around the buggy address:
0x5060000cfd00: 00 00 07 fa fa fa fa fa 00 00 00 00 00 00 00 00
0x5060000cfd80: fa fa fa fa 00 00 00 00 00 00 07 fa fa fa fa fa
0x5060000cfe00: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
0x5060000cfe80: 00 00 00 00 fa fa fa fa fd fd fd fd fd fd fd fa
0x5060000cff00: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
=>0x5060000cff80: fd fd fd[fd]fd fd fd fd fa fa fa fa fd fd fd fd
0x5060000d0000: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
0x5060000d0080: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
0x5060000d0100: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd
0x5060000d0180: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00
0x5060000d0200: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1348779==ABORTING