Address Sanitizer on a python extension result in AddressSanitizer:DEADLYSIGNAL - address-sanitizer

Question

c source code as below:
#include<stdlib.h>
#include<stdio.h>
#include "demo_c.h"
void func(data_pair* pair) {
printf("func called");
pair->len=4;
pair->data = (char*)malloc(pair->len + 1);
memset(pair->data, 0, pair->len + 1);
memcpy(pair->data, "test", 4);
return;
}
gcc -fpic -c demo_c.c -fno-omit-frame-pointer -fsanitize=address -fsanitize-recover=address
gcc --share demo_c.o -o libdemo_c.so
then I import this library in python like this:
from ctypes import *
demo_c = CDLL('/xxx/libdemo_c.so', RTLD_GLOBAL)
libc = CDLL('libc.so.6')
libc.free.argtypes = [c_void_p]
class entry(Structure):
_fields_ = [('len',c_int),
('data', c_void_p)]
v = entry()
demo_c.func.argtypes = [c_void_p]
demo_c.func(byref(v))
libc.free(v.data)
then I run:
LD_PRELOAD=/lib64/libasan.so.5 python demo.py
output is:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==432489==ERROR: AddressSanitizer: BUS on unknown address 0x000000000000 (pc 0x7f281c9c90fe bp 0x200000000000003 sp 0x7ffe0c369b20 T0)
#0 0x7f281c9c90fd in _int_free (/lib64/libc.so.6+0x810fd)
#1 0x7f281356cdcb in ffi_call_unix64 (/lib64/libffi.so.6+0x5dcb)
#2 0x7f281356c6f4 in ffi_call (/lib64/libffi.so.6+0x56f4)
#3 0x7f281377fc6a in _ctypes_callproc (/usr/lib64/python2.7/lib-dynload/_ctypes.so+0x10c6a)
#4 0x7f2813779a64 (/usr/lib64/python2.7/lib-dynload/_ctypes.so+0xaa64)
#5 0x7f281d687072 in PyObject_Call (/lib64/libpython2.7.so.1.0+0x4c072)
#6 0x7f281d71b845 in PyEval_EvalFrameEx (/lib64/libpython2.7.so.1.0+0xe0845)
#7 0x7f281d72264c in PyEval_EvalCodeEx (/lib64/libpython2.7.so.1.0+0xe764c)
#8 0x7f281d722751 in PyEval_EvalCode (/lib64/libpython2.7.so.1.0+0xe7751)
#9 0x7f281d73bb8e (/lib64/libpython2.7.so.1.0+0x100b8e)
#10 0x7f281d73cd5d in PyRun_FileExFlags (/lib64/libpython2.7.so.1.0+0x101d5d)
#11 0x7f281d73dfe8 in PyRun_SimpleFileExFlags (/lib64/libpython2.7.so.1.0+0x102fe8)
#12 0x7f281d74f19e in Py_Main (/lib64/libpython2.7.so.1.0+0x11419e)
#13 0x7f281c96a554 in __libc_start_main (/lib64/libc.so.6+0x22554)
#14 0x40068d (/usr/bin/python2.7+0x40068d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS (/lib64/libc.so.6+0x810fd) in _int_free
==432489==ABORTING
But if I wrap libc.so's free in demo_c.c and call it instead of directly calling free directly in python code, it works fine.

Answer 1

Problem is that you allocate your memory with Asan's malloc and later try to release it with libc's free. This is not going to work as different allocators are generally incompatible.