Still possible!
/Users/karo/sw/gmic/src $ lldb ./gmic demos
(lldb) target create “./gmic”
Current executable set to ‘/Users/karo/sw/gmic/src/gmic’ (x86_64).
(lldb) settings set – target.run-args “demos”
(lldb) run
Process 12306 launched: ‘/Users/karo/sw/gmic/src/gmic’ (x86_64)
gmic(12306,0x101ac0600) malloc: nano zone abandoned due to inability to preallocate reserved vm space.
[gmic]-0./ Start G’MIC interpreter.
------ G’MIC demos ------------------
---- Mouse button to select a demo.
---- Keys ‘CTRL+D’ to increase window size.
---- Keys ‘CTRL+C’ to reset window size.
---- Keys ‘ESC’ or ‘Q’ to exit.
------ Color curves ----------------------------------------------------------------------------
---- Left mouse button on a curve creates a new control point (or moves an existing one).
---- Right mouse button on a control point deletes it.
---- Left mouse button on the main image window shows the initial image until button is released.
---- Right mouse button on the main image window adds a keypoint to all curves from picked color.
---- Key ‘R’ on a curve resets it.
---- Keys ‘CTRL+D’ increase window size.
---- Keys ‘CTRL+C’ decrease window size.
---- Keys ‘CTRL+R’ reset window size.
---- Keys ‘ESC’, ‘Q’ or ‘ENTER’ close the current window.
------------------------------------------------------------------------------------------------=================================================================
==12306==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e000127168 at pc 0x0001001e74ac bp 0x7ff7bfe79ff0 sp 0x7ff7bfe79fe8
READ of size 8 at 0x61e000127168 thread T0
#0 0x1001e74ab in gmic::current_is_abort() gmic.cpp:2393
#1 0x1005814b4 in gmic_library::gmic_image::_fill(char const*, bool, unsigned int, gmic_library::gmic_list, char const, gmic_library::gmic_image const*) CImg.h:32344
#2 0x1002443b5 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14954
#3 0x10025afc2 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:9086
#4 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#5 0x10020c0b9 in gmic& gmic::_run(gmic_library::gmic_list const&, gmic_library::gmic_list&, gmic_library::gmic_list&, float*, bool*) gmic.cpp:5406
#6 0x101622273 in gmic& gmic::run(char const*, gmic_library::gmic_list&, gmic_library::gmic_list&, float*, bool*) gmic.cpp:5370
#7 0x100007af3 in main gmic_cli.cpp:231
#8 0x101a4552d in start+0x1cd (dyld:x86_64+0x552d)
0x61e000127168 is located 1256 bytes inside of 2568-byte region [0x61e000126c80,0x61e000127688)
freed by thread T2 here:
#0 0x102d2c72d in wrap__ZdaPv+0x7d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c72d)
#1 0x1002a0a8c in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:11013
#2 0x10026b996 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:8080
#3 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#4 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#5 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#6 0x10025afc2 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:9086
#7 0x1008007b4 in void* gmic_parallel(void*) gmic.cpp:2706
#8 0x7ff8051004e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0)
#9 0x7ff8050fbf6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a)
previously allocated by thread T2 here:
#0 0x102d2c31d in wrap__Znam+0x7d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c31d)
#1 0x10029ed2e in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:10886
#2 0x10026b996 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:8080
#3 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#4 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#5 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#6 0x10025afc2 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:9086
#7 0x1008007b4 in void* gmic_parallel(void*) gmic.cpp:2706
#8 0x7ff8051004e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0)
#9 0x7ff8050fbf6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a)
Thread T2 created by T0 here:
#0 0x102d1499c in wrap_pthread_create+0x5c (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4499c)
#1 0x1002a0380 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:10986
#2 0x10025afc2 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:9086
#3 0x10023b0f4 in gmic& gmic::_run(gmic_library::gmic_list const&, unsigned int&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, gmic_library::gmic_list&, unsigned int const*, bool*, char const*, gmic_library::gmic_image const*) gmic.cpp:14431
#4 0x10020c0b9 in gmic& gmic::_run(gmic_library::gmic_list const&, gmic_library::gmic_list&, gmic_library::gmic_list&, float*, bool*) gmic.cpp:5406
#5 0x101622273 in gmic& gmic::run(char const*, gmic_library::gmic_list&, gmic_library::gmic_list&, float*, bool*) gmic.cpp:5370
#6 0x100007af3 in main gmic_cli.cpp:231
#7 0x101a4552d in start+0x1cd (dyld:x86_64+0x552d)
SUMMARY: AddressSanitizer: heap-use-after-free gmic.cpp:2393 in gmic::current_is_abort()
Shadow bytes around the buggy address:
0x1c3c00024dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024de0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024df0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024e10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x1c3c00024e20: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
0x1c3c00024e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024e50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024e60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3c00024e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==12306==ABORTING
(lldb) AddressSanitizer report breakpoint hit. Use ‘thread info -s’ to get extended information about the report.
Process 12306 stopped
- thread #1, queue = ‘com.apple.main-thread’, stop reason = Use of deallocated memory
frame #0: 0x0000000102d25fa0 libclang_rt.asan_osx_dynamic.dylib__asan::AsanDie() libclang_rt.asan_osx_dynamic.dylib
__asan::AsanDie:
→ 0x102d25fa0 <+0>: pushq %rbp
0x102d25fa1 <+1>: movq %rsp, %rbp
0x102d25fa4 <+4>: pushq %rbx
0x102d25fa5 <+5>: pushq %rax
Target 0: (gmic) stopped.
(lldb)