Fund: RequestServer: Use-after-free when loading GitHub profile

Reproducible with sanitizers by loading https://github.com/awesomekling
/home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/NetworkJob.h:60:76: runtime error: member call on address 0x503000086c20 which does not point to an object of type 'AK::Stream'
0x503000086c20: note: object has invalid vptr
 00 00 00 00  05 11 00 00 00 00 00 00  02 00 00 00 ff ff ff ff  00 be be be 00 00 00 00  00 00 01 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
    #0 0x7fe4bf3da8ba in Core::NetworkJob::do_write(AK::Span<unsigned char const>) /home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/NetworkJob.h:60:76
    #1 0x7fe4bf3bc12f in HTTP::Job::flush_received_buffers() /home/kling/src/serenity/Userland/Libraries/LibHTTP/Job.cpp:130:23
    #2 0x7fe4bf3c3ecc in HTTP::Job::finish_up() /home/kling/src/serenity/Userland/Libraries/LibHTTP/Job.cpp:627:5
    #3 0x7fe4bf3bf5a3 in HTTP::Job::timer_event(Core::TimerEvent&) /home/kling/src/serenity/Userland/Libraries/LibHTTP/Job.cpp:590:5
    #4 0x7fe4bed622ee in Core::EventReceiver::dispatch_event(Core::Event&, Core::EventReceiver*) /home/kling/src/serenity/Userland/Libraries/LibCore/EventReceiver.cpp:162:17
    #5 0x7fe4bedd9330 in Core::ThreadEventQueue::process() /home/kling/src/serenity/Userland/Libraries/LibCore/ThreadEventQueue.cpp:111:23
    #6 0x7fe4bed466ad in Core::EventLoopImplementationUnix::exec() /home/kling/src/serenity/Userland/Libraries/LibCore/EventLoopImplementationUnix.cpp:277:9
    #7 0x7fe4bed41671 in Core::EventLoop::exec() /home/kling/src/serenity/Userland/Libraries/LibCore/EventLoop.cpp:88:20
    #8 0x5df0cd28bebb in serenity_main(Main::Arguments) /home/kling/src/serenity/Ladybird/RequestServer/main.cpp:57:23
    #9 0x5df0cd39f707 in main /home/kling/src/serenity/Userland/Libraries/LibMain/Main.cpp:39:19
    #10 0x7fe4be22814f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x7fe4be228208 in __libc_start_main csu/../csu/libc-start.c:360:3
    #12 0x5df0cd1ae224 in _start (/home/kling/src/serenity/Build/lagom/libexec/RequestServer+0x133224) (BuildId: 80fa9f5871793558)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/NetworkJob.h:60:76 in
=================================================================
==3452045==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000086c20 at pc 0x7fe4bf3da8d3 bp 0x7ffead821210 sp 0x7ffead821208
READ of size 8 at 0x503000086c20 thread T0
    #0 0x7fe4bf3da8d2 in Core::NetworkJob::do_write(AK::Span<unsigned char const>) /home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/NetworkJob.h:60:76
    #1 0x7fe4bf3bc12f in HTTP::Job::flush_received_buffers() /home/kling/src/serenity/Userland/Libraries/LibHTTP/Job.cpp:130:23
    #2 0x7fe4bf3c3ecc in HTTP::Job::finish_up() /home/kling/src/serenity/Userland/Libraries/LibHTTP/Job.cpp:627:5
    #3 0x7fe4bf3bf5a3 in HTTP::Job::timer_event(Core::TimerEvent&) /home/kling/src/serenity/Userland/Libraries/LibHTTP/Job.cpp:590:5
    #4 0x7fe4bed622ee in Core::EventReceiver::dispatch_event(Core::Event&, Core::EventReceiver*) /home/kling/src/serenity/Userland/Libraries/LibCore/EventReceiver.cpp:162:17
    #5 0x7fe4bedd9330 in Core::ThreadEventQueue::process() /home/kling/src/serenity/Userland/Libraries/LibCore/ThreadEventQueue.cpp:111:23
    #6 0x7fe4bed466ad in Core::EventLoopImplementationUnix::exec() /home/kling/src/serenity/Userland/Libraries/LibCore/EventLoopImplementationUnix.cpp:277:9
    #7 0x7fe4bed41671 in Core::EventLoop::exec() /home/kling/src/serenity/Userland/Libraries/LibCore/EventLoop.cpp:88:20
    #8 0x5df0cd28bebb in serenity_main(Main::Arguments) /home/kling/src/serenity/Ladybird/RequestServer/main.cpp:57:23
    #9 0x5df0cd39f707 in main /home/kling/src/serenity/Userland/Libraries/LibMain/Main.cpp:39:19
    #10 0x7fe4be22814f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x7fe4be228208 in __libc_start_main csu/../csu/libc-start.c:360:3
    #12 0x5df0cd1ae224 in _start (/home/kling/src/serenity/Build/lagom/libexec/RequestServer+0x133224) (BuildId: 80fa9f5871793558)

0x503000086c20 is located 0 bytes inside of 32-byte region [0x503000086c20,0x503000086c40)
freed by thread T0 here:
    #0 0x5df0cd289981 in operator delete(void*) (/home/kling/src/serenity/Build/lagom/libexec/RequestServer+0x20e981) (BuildId: 80fa9f5871793558)
    #1 0x5df0cd369f81 in ~NonnullOwnPtr /home/kling/src/serenity/Meta/Lagom/../../AK/NonnullOwnPtr.h:50:9
    #2 0x5df0cd369f81 in RequestServer::Request::~Request() /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/Request.h:20:32
    #3 0x5df0cd3968ed in RequestServer::HttpsRequest::~HttpsRequest() /home/kling/src/serenity/Userland/Services/RequestServer/HttpsRequest.cpp:27:1
    #4 0x5df0cd30566f in operator() /home/kling/src/serenity/Meta/Lagom/../../AK/DefaultDelete.h:17:9
    #5 0x5df0cd30566f in clear /home/kling/src/serenity/Meta/Lagom/../../AK/OwnPtr.h:110:9
    #6 0x5df0cd30566f in ~OwnPtr /home/kling/src/serenity/Meta/Lagom/../../AK/OwnPtr.h:45:9
    #7 0x5df0cd30566f in ~Entry /home/kling/src/serenity/Meta/Lagom/../../AK/HashMap.h:23:12
    #8 0x5df0cd30566f in AK::HashTable<AK::HashMap<int, AK::OwnPtr<RequestServer::Request, AK::DefaultDelete<RequestServer::Request>>, AK::Traits<int>, AK::Traits<AK::OwnPtr<RequestServer::Request, AK::DefaultDelete<RequestServer::Request>>>, false>::Entry, AK::HashMap<int, AK::OwnPtr<RequestServer::Request, AK::DefaultDelete<RequestServer::Request>>, AK::Traits<int>, AK::Traits<AK::OwnPtr<RequestServer::Request, AK::DefaultDelete<RequestServer::Request>>>, false>::EntryTraits, false>::~HashTable() /home/kling/src/serenity/Meta/Lagom/../../AK/HashTable.h:166:43
    #9 0x5df0cd2a0531 in ~HashMap /home/kling/src/serenity/Meta/Lagom/../../AK/HashMap.h:21:7
    #10 0x5df0cd2a0531 in RequestServer::ConnectionFromClient::~ConnectionFromClient() /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/ConnectionFromClient.h:23:46
    #11 0x5df0cd2a05ed in RequestServer::ConnectionFromClient::~ConnectionFromClient() /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/ConnectionFromClient.h:23:46
    #12 0x7fe4bfb2c391 in AK::RefCounted<Core::EventReceiver>::unref() const /home/kling/src/serenity/Meta/Lagom/../../AK/RefCounted.h:65:13
    #13 0x7fe4bed44706 in AK::Function<void ()>::clear(bool) /home/kling/src/serenity/Meta/Lagom/../../AK/Function.h
    #14 0x7fe4bed45ff6 in ~Function /home/kling/src/serenity/Meta/Lagom/../../AK/Function.h:84:9
    #15 0x7fe4bed45ff6 in ~DeferredInvocationEvent /home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/Event.h:50:7
    #16 0x7fe4bed45ff6 in Core::DeferredInvocationEvent::~DeferredInvocationEvent() /home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/Event.h:50:7
    #17 0x7fe4beddbe42 in clear /home/kling/src/serenity/Meta/Lagom/../../AK/NonnullOwnPtr.h:133:9
    #18 0x7fe4beddbe42 in ~NonnullOwnPtr /home/kling/src/serenity/Meta/Lagom/../../AK/NonnullOwnPtr.h:50:9
    #19 0x7fe4beddbe42 in Core::ThreadEventQueue::Private::QueuedEvent::~QueuedEvent() /home/kling/src/serenity/Userland/Libraries/LibCore/ThreadEventQueue.cpp:30:32
    #20 0x7fe4beddd6d1 in clear_with_capacity /home/kling/src/serenity/Meta/Lagom/../../AK/Vector.h:383:24
    #21 0x7fe4beddd6d1 in AK::Vector<Core::ThreadEventQueue::Private::QueuedEvent, 128ul>::clear() /home/kling/src/serenity/Meta/Lagom/../../AK/Vector.h:372:9
    #22 0x7fe4bedd9b3d in ~Vector /home/kling/src/serenity/Meta/Lagom/../../AK/Vector.h:110:9
    #23 0x7fe4bedd9b3d in Core::ThreadEventQueue::process() /home/kling/src/serenity/Userland/Libraries/LibCore/ThreadEventQueue.cpp:124:1
    #24 0x7fe4bed466ad in Core::EventLoopImplementationUnix::exec() /home/kling/src/serenity/Userland/Libraries/LibCore/EventLoopImplementationUnix.cpp:277:9
    #25 0x7fe4bed41671 in Core::EventLoop::exec() /home/kling/src/serenity/Userland/Libraries/LibCore/EventLoop.cpp:88:20
    #26 0x5df0cd28bebb in serenity_main(Main::Arguments) /home/kling/src/serenity/Ladybird/RequestServer/main.cpp:57:23
    #27 0x5df0cd39f707 in main /home/kling/src/serenity/Userland/Libraries/LibMain/Main.cpp:39:19
    #28 0x7fe4be22814f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

previously allocated by thread T0 here:
    #0 0x5df0cd289341 in operator new(unsigned long, std::nothrow_t const&) (/home/kling/src/serenity/Build/lagom/libexec/RequestServer+0x20e341) (BuildId: 80fa9f5871793558)
    #1 0x7fe4bebbdf55 in Core::File::adopt_fd(int, Core::File::OpenMode, Core::File::ShouldCloseFileDescriptor) /home/kling/src/serenity/Userland/Libraries/LibCore/File.cpp:33:17
    #2 0x5df0cd38bc33 in AK::OwnPtr<RequestServer::Request, AK::DefaultDelete<RequestServer::Request>> RequestServer::Detail::start_request<AK::Badge<RequestServer::HttpsProtocol>, AK::ErrorOr<RequestServer::Protocol::Pipe, AK::Error>>(AK::Badge<RequestServer::HttpsProtocol>&&, int, RequestServer::ConnectionFromClient&, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Span<unsigned char const>, AK::ErrorOr<RequestServer::Protocol::Pipe, AK::Error>&&, Core::ProxyData) /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/HttpCommon.h:100:26
    #3 0x5df0cd38ac16 in RequestServer::HttpsProtocol::start_request(int, RequestServer::ConnectionFromClient&, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Span<unsigned char const>, Core::ProxyData) /home/kling/src/serenity/Userland/Services/RequestServer/HttpsProtocol.cpp:27:12
    #4 0x5df0cd2916fb in RequestServer::ConnectionFromClient::start_request(int, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Detail::ByteBuffer<32ul> const&, Core::ProxyData const&) /home/kling/src/serenity/Userland/Services/RequestServer/ConnectionFromClient.cpp:85:30
    #5 0x5df0cd2a2b29 in RequestServerStub::handle(IPC::Message const&) /home/kling/src/serenity/Build/lagom/Userland/Services/RequestServer/RequestServerEndpoint.h:1657:13
    #6 0x7fe4bfb22c51 in IPC::ConnectionBase::handle_messages() /home/kling/src/serenity/Userland/Libraries/LibIPC/Connection.cpp:77:48
    #7 0x7fe4bed65ecf in AK::Function<void ()>::operator()() const /home/kling/src/serenity/Meta/Lagom/../../AK/Function.h:125:25
    #8 0x7fe4bedd91f3 in Core::ThreadEventQueue::process() /home/kling/src/serenity/Userland/Libraries/LibCore/ThreadEventQueue.cpp:108:13
    #9 0x7fe4bf1ca839 in Core::Promise<AK::Empty, AK::Error>::await() /home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/Promise.h:56:40
    #10 0x7fe4bf1c0cc7 in TLS::TLSv12::connect(AK::ByteString const&, unsigned short, TLS::Options) /home/kling/src/serenity/Userland/Libraries/LibTLS/Socket.cpp:68:5
    #11 0x5df0cd2de0b8 in AK::ErrorOr<AK::NonnullOwnPtr<TLS::TLSv12>, AK::Error> RequestServer::ConnectionCache::Proxy::tunnel<TLS::TLSv12, TLS::TLSv12>(URL::URL const&) /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/ConnectionCache.h:40:20
    #12 0x5df0cd38d20d in decltype(auto) RequestServer::ConnectionCache::get_or_create_connection<AK::HashMap<RequestServer::ConnectionCache::ConnectionKey, AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>, AK::Traits<RequestServer::ConnectionCache::ConnectionKey>, AK::Traits<AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>>, false>, AK::NonnullRefPtr<HTTP::HttpsJob>>(AK::HashMap<RequestServer::ConnectionCache::ConnectionKey, AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>, AK::Traits<RequestServer::ConnectionCache::ConnectionKey>, AK::Traits<AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>>, false>&, URL::URL const&, AK::NonnullRefPtr<HTTP::HttpsJob>, Core::ProxyData) /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/ConnectionCache.h:201:40
    #13 0x5df0cd38c1bf in AK::OwnPtr<RequestServer::Request, AK::DefaultDelete<RequestServer::Request>> RequestServer::Detail::start_request<AK::Badge<RequestServer::HttpsProtocol>, AK::ErrorOr<RequestServer::Protocol::Pipe, AK::Error>>(AK::Badge<RequestServer::HttpsProtocol>&&, int, RequestServer::ConnectionFromClient&, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Span<unsigned char const>, AK::ErrorOr<RequestServer::Protocol::Pipe, AK::Error>&&, Core::ProxyData) /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/HttpCommon.h:106:9
    #14 0x5df0cd38ac16 in RequestServer::HttpsProtocol::start_request(int, RequestServer::ConnectionFromClient&, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Span<unsigned char const>, Core::ProxyData) /home/kling/src/serenity/Userland/Services/RequestServer/HttpsProtocol.cpp:27:12
    #15 0x5df0cd2916fb in RequestServer::ConnectionFromClient::start_request(int, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Detail::ByteBuffer<32ul> const&, Core::ProxyData const&) /home/kling/src/serenity/Userland/Services/RequestServer/ConnectionFromClient.cpp:85:30
    #16 0x5df0cd2a2b29 in RequestServerStub::handle(IPC::Message const&) /home/kling/src/serenity/Build/lagom/Userland/Services/RequestServer/RequestServerEndpoint.h:1657:13
    #17 0x7fe4bfb22c51 in IPC::ConnectionBase::handle_messages() /home/kling/src/serenity/Userland/Libraries/LibIPC/Connection.cpp:77:48
    #18 0x7fe4bed65ecf in AK::Function<void ()>::operator()() const /home/kling/src/serenity/Meta/Lagom/../../AK/Function.h:125:25
    #19 0x7fe4bedd91f3 in Core::ThreadEventQueue::process() /home/kling/src/serenity/Userland/Libraries/LibCore/ThreadEventQueue.cpp:108:13
    #20 0x7fe4bf1ca839 in Core::Promise<AK::Empty, AK::Error>::await() /home/kling/src/serenity/Meta/Lagom/../../Userland/Libraries/LibCore/Promise.h:56:40
    #21 0x7fe4bf1c0cc7 in TLS::TLSv12::connect(AK::ByteString const&, unsigned short, TLS::Options) /home/kling/src/serenity/Userland/Libraries/LibTLS/Socket.cpp:68:5
    #22 0x5df0cd2de0b8 in AK::ErrorOr<AK::NonnullOwnPtr<TLS::TLSv12>, AK::Error> RequestServer::ConnectionCache::Proxy::tunnel<TLS::TLSv12, TLS::TLSv12>(URL::URL const&) /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/ConnectionCache.h:40:20
    #23 0x5df0cd38d20d in decltype(auto) RequestServer::ConnectionCache::get_or_create_connection<AK::HashMap<RequestServer::ConnectionCache::ConnectionKey, AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>, AK::Traits<RequestServer::ConnectionCache::ConnectionKey>, AK::Traits<AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>>, false>, AK::NonnullRefPtr<HTTP::HttpsJob>>(AK::HashMap<RequestServer::ConnectionCache::ConnectionKey, AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>, AK::Traits<RequestServer::ConnectionCache::ConnectionKey>, AK::Traits<AK::NonnullOwnPtr<AK::Vector<AK::NonnullOwnPtr<RequestServer::ConnectionCache::Connection<TLS::TLSv12, TLS::TLSv12>>, 0ul>>>, false>&, URL::URL const&, AK::NonnullRefPtr<HTTP::HttpsJob>, Core::ProxyData) /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/ConnectionCache.h:201:40
    #24 0x5df0cd38c1bf in AK::OwnPtr<RequestServer::Request, AK::DefaultDelete<RequestServer::Request>> RequestServer::Detail::start_request<AK::Badge<RequestServer::HttpsProtocol>, AK::ErrorOr<RequestServer::Protocol::Pipe, AK::Error>>(AK::Badge<RequestServer::HttpsProtocol>&&, int, RequestServer::ConnectionFromClient&, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Span<unsigned char const>, AK::ErrorOr<RequestServer::Protocol::Pipe, AK::Error>&&, Core::ProxyData) /home/kling/src/serenity/Meta/Lagom/../../Userland/Services/RequestServer/HttpCommon.h:106:9
    #25 0x5df0cd38ac16 in RequestServer::HttpsProtocol::start_request(int, RequestServer::ConnectionFromClient&, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Span<unsigned char const>, Core::ProxyData) /home/kling/src/serenity/Userland/Services/RequestServer/HttpsProtocol.cpp:27:12
    #26 0x5df0cd2916fb in RequestServer::ConnectionFromClient::start_request(int, AK::ByteString const&, URL::URL const&, AK::HashMap<AK::ByteString, AK::ByteString, AK::Traits<AK::ByteString>, AK::Traits<AK::ByteString>, false> const&, AK::Detail::ByteBuffer<32ul> const&, Core::ProxyData const&) /home/kling/src/serenity/Userland/Services/RequestServer/ConnectionFromClient.cpp:85:30
    #27 0x5df0cd2a2b29 in RequestServerStub::handle(IPC::Message const&) /home/kling/src/serenity/Build/lagom/Userland/Services/RequestServer/RequestServerEndpoint.h:1657:13
    #28 0x7fe4bfb22c51 in IPC::ConnectionBase::handle_messages() /home/kling/src/serenity/Userland/Libraries/LibIPC/Connection.cpp:77:48
    #29 0x7fe4bed65ecf in AK::Function<void ()>::operator()() const /home/kling/src/serenity/Meta/Lagom/../../AK/Function.h:125:25
SerenityOS/serenity

RequestServer: Use-after-free when loading GitHub profile

How does funding with Polar work?

Backer

Contributor

Maintainer

SerenityOS/serenity

RequestServer: Use-after-free when loading GitHub profile

How does funding with Polar work?

Backer

Why does "Fund on completion" require GitHub login?

When is the invoice due for "Fund on completion"?

What happens if the issue is never completed?

Do I get any extra benefits by funding?

Do I get progress updates?

Contributor

Do I get a reward?

Is rewards guaranteed?

Maintainer

How can I get funding like this for my open source initiatives?
