UAF 通过 `bufferevent_finalize_cb_` 中的共享锁生命周期不匹配
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000000078 at pc 0x5614b35499e4 bp 0x7ffc9e7bf6c0 sp 0x7ffc9e7bf6b8 READ of size 8 at 0x50d000000078 thread T0 #0 0x5614b35499e3 in main /src/poc/poc_uaf_lock.c:89 #1 0x7f7b0310dca7 (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: 58749c528985eab03e6700ebc1469fa50aa41219) #2 0x7f7b0310dd64 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29d64) (BuildId: 58749c528985eab03e6700ebc1469fa50aa41219) #3 0x5614b3549270 in start (/src/poc/poc_uaf_lock+0x2270) (BuildId: 6395d19b949aa674aaebe690eed280c5504f30cc) 0x50d000000078 is located 56 bytes inside of 144-byte region [0x50d000000040,0x50d0000000d0), freed by thread T0 here: #0 0x7f7b034c08f8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7f7b0337d347 in bufferevent_finalize_cb …
内容来源: libevent/libevent