  adding: secilc/test/block_test.cil (deflated 67%)
Running: docker build -t gcr.io/oss-fuzz/selinux projects/selinux
Cleaning existing build artifacts.
Running: docker run --rm --privileged -i -v /tmp/tmph1ht1j27/oss-fuzz/build/out/selinux:/out -t gcr.io/oss-fuzz/selinux /bin/bash -c 'rm -rf /out/*'
Running: docker run --rm --privileged -i -v /tmp/tmph1ht1j27/oss-fuzz/build/work/selinux:/work -t gcr.io/oss-fuzz/selinux /bin/bash -c 'rm -rf /work/*'
Running: docker run --rm --privileged -i --cap-add SYS_PTRACE -e FUZZING_ENGINE=libfuzzer -e SANITIZER=address -e ARCHITECTURE=x86_64 -e FUZZING_LANGUAGE=c -v /tmp/tmph1ht1j27/selinux:/src/selinux -v /tmp/tmph1ht1j27/oss-fuzz/build/out/selinux:/out -v /tmp/tmph1ht1j27/oss-fuzz/build/work/selinux:/work -t gcr.io/oss-fuzz/selinux
/tmp/tmph1ht1j27/oss-fuzz$ /usr/bin/python3 infra/helper.py reproduce selinux secilc-fuzzer /home/bradswain/testcases/selinux/OSV-2021-270
/tmp/tmph1ht1j27/oss-fuzz/infra/helper.py:27: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
+ FUZZER=secilc-fuzzer
+ shift
+ '[' '!' -v TESTCASE ']'
+ TESTCASE=/testcase
+ '[' '!' -f /testcase ']'
+ export RUN_FUZZER_MODE=interactive
+ RUN_FUZZER_MODE=interactive
+ export FUZZING_ENGINE=libfuzzer
+ FUZZING_ENGINE=libfuzzer
+ export SKIP_SEED_CORPUS=1
+ SKIP_SEED_CORPUS=1
+ run_fuzzer secilc-fuzzer -runs=100 /testcase
vm.mmap_rnd_bits = 28
/out/secilc-fuzzer -rss_limit_mb=2560 -timeout=25 -runs=100 /testcase < /dev/null
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2374174406
INFO: Loaded 1 modules   (17391 inline 8-bit counters): 17391 [0x561fc6b4ea88, 0x561fc6b52e77), 
INFO: Loaded 1 PC tables (17391 PCs): 17391 [0x561fc6b52e78,0x561fc6b96d68), 
/out/secilc-fuzzer: Running 1 inputs 100 time(s) each.
Running: /testcase
Recursive blockinherit found:
block b at fuzz:1
blockinherit b at fuzz:1
=================================================================
[1m[31m==14==ERROR: AddressSanitizer: heap-use-after-free on address 0x5060000006a0 at pc 0x561fc69a2f48 bp 0x7ffc0b6f8980 sp 0x7ffc0b6f8978
[1m[0m[1m[34mREAD of size 4 at 0x5060000006a0 thread T0[1m[0m
SCARINESS: 45 (4-byte-read-heap-use-after-free)
    #0 0x561fc69a2f47 in cil_destroy_block /src/selinux/libsepol/src/../cil/src/cil_build_ast.c:230:17
    #1 0x561fc6976fbc in cil_destroy_data /src/selinux/libsepol/src/../cil/src/cil.c:626:3
    #2 0x561fc6a1c6fe in cil_tree_node_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c
    #3 0x561fc6a1c6fe in cil_tree_children_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c
    #4 0x561fc6a1c1a3 in cil_tree_subtree_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c:172:2
    #5 0x561fc6a1c1a3 in cil_tree_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c:165:2
    #6 0x561fc69750ed in cil_db_destroy /src/selinux/libsepol/src/../cil/src/cil.c:453:2
    #7 0x561fc695da5a in LLVMFuzzerTestOneInput /src/secilc-fuzzer.c:83:2
    #8 0x561fc6812330 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #9 0x561fc67fd5a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #10 0x561fc680303f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #11 0x561fc682e2e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #12 0x7f5f7a89f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)
    #13 0x561fc67f578d in _start (/out/secilc-fuzzer+0xc578d)

DEDUP_TOKEN: cil_destroy_block--cil_destroy_data--cil_tree_node_destroy
[1m[32m0x5060000006a0 is located 32 bytes inside of 56-byte region [0x506000000680,0x5060000006b8)
[1m[0m[1m[35mfreed by thread T0 here:[1m[0m
    #0 0x561fc691de66 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
    #1 0x561fc6a1c706 in cil_tree_node_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c:240:2
    #2 0x561fc6a1c706 in cil_tree_children_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c
    #3 0x561fc6a1c1a3 in cil_tree_subtree_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c:172:2
    #4 0x561fc6a1c1a3 in cil_tree_destroy /src/selinux/libsepol/src/../cil/src/cil_tree.c:165:2
    #5 0x561fc69750ed in cil_db_destroy /src/selinux/libsepol/src/../cil/src/cil.c:453:2
    #6 0x561fc695da5a in LLVMFuzzerTestOneInput /src/secilc-fuzzer.c:83:2
    #7 0x561fc6812330 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #8 0x561fc67fd5a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #9 0x561fc680303f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #10 0x561fc682e2e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #11 0x7f5f7a89f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)

DEDUP_TOKEN: __interceptor_free--cil_tree_node_destroy--cil_tree_children_destroy
[1m[35mpreviously allocated by thread T0 here:[1m[0m
    #0 0x561fc691e0ff in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #1 0x561fc69dae77 in cil_malloc /src/selinux/libsepol/src/../cil/src/cil_mem.c:39:14
    #2 0x561fc6a1c02e in cil_tree_node_init /src/selinux/libsepol/src/../cil/src/cil_tree.c:210:35
    #3 0x561fc69c4256 in __cil_build_ast_node_helper /src/selinux/libsepol/src/../cil/src/cil_build_ast.c:6169:2
    #4 0x561fc6a1ca9b in cil_tree_walk_core /src/selinux/libsepol/src/../cil/src/cil_tree.c:272:9
    #5 0x561fc6a1cc81 in cil_tree_walk /src/selinux/libsepol/src/../cil/src/cil_tree.c:316:7
    #6 0x561fc6a1cc81 in cil_tree_walk_core /src/selinux/libsepol/src/../cil/src/cil_tree.c:284:9
    #7 0x561fc6a1cc81 in cil_tree_walk /src/selinux/libsepol/src/../cil/src/cil_tree.c:316:7
    #8 0x561fc6a1cc81 in cil_tree_walk_core /src/selinux/libsepol/src/../cil/src/cil_tree.c:284:9
    #9 0x561fc6a1cc81 in cil_tree_walk /src/selinux/libsepol/src/../cil/src/cil_tree.c:316:7
    #10 0x561fc6a1cc81 in cil_tree_walk_core /src/selinux/libsepol/src/../cil/src/cil_tree.c:284:9
    #11 0x561fc6a1ce8e in cil_tree_walk /src/selinux/libsepol/src/../cil/src/cil_tree.c:316:7
    #12 0x561fc69c752c in cil_build_ast /src/selinux/libsepol/src/../cil/src/cil_build_ast.c:6550:7
    #13 0x561fc6976c7a in cil_compile /src/selinux/libsepol/src/../cil/src/cil.c:540:7
    #14 0x561fc695d958 in LLVMFuzzerTestOneInput /src/secilc-fuzzer.c:59:6
    #15 0x561fc6812330 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #16 0x561fc67fd5a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #17 0x561fc680303f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #18 0x561fc682e2e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #19 0x7f5f7a89f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)

DEDUP_TOKEN: __interceptor_malloc--cil_malloc--cil_tree_node_init
SUMMARY: AddressSanitizer: heap-use-after-free /src/selinux/libsepol/src/../cil/src/cil_build_ast.c:249:17 in cil_destroy_block
Shadow bytes around the buggy address:
  0x506000000400: [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m
  0x506000000480: [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m
  0x506000000500: [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m
  0x506000000580: [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[31mfa[1m[0m
  0x506000000600: [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[0m00[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m
=>0x506000000680: [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m[[1m[35mfd[1m[0m][1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m
  0x506000000700: [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m
  0x506000000780: [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[35mfd[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m
  0x506000000800: [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m
  0x506000000880: [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m
  0x506000000900: [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m [1m[31mfa[1m[0m
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           [1m[0m00[1m[0m
  Partially addressable: [1m[0m01[1m[0m [1m[0m02[1m[0m [1m[0m03[1m[0m [1m[0m04[1m[0m [1m[0m05[1m[0m [1m[0m06[1m[0m [1m[0m07[1m[0m 
  Heap left redzone:       [1m[31mfa[1m[0m
  Freed heap region:       [1m[35mfd[1m[0m
  Stack left redzone:      [1m[31mf1[1m[0m
  Stack mid redzone:       [1m[31mf2[1m[0m
  Stack right redzone:     [1m[31mf3[1m[0m
  Stack after return:      [1m[35mf5[1m[0m
  Stack use after scope:   [1m[35mf8[1m[0m
  Global redzone:          [1m[31mf9[1m[0m
  Global init order:       [1m[36mf6[1m[0m
  Poisoned by user:        [1m[34mf7[1m[0m
  Container overflow:      [1m[34mfc[1m[0m
  Array cookie:            [1m[31mac[1m[0m
  Intra object redzone:    [1m[33mbb[1m[0m
  ASan internal:           [1m[33mfe[1m[0m
  Left alloca redzone:     [1m[34mca[1m[0m
  Right alloca redzone:    [1m[34mcb[1m[0m
==14==ABORTING
Running: docker run --rm --privileged -i -v /tmp/tmph1ht1j27/oss-fuzz/build/out/selinux:/out -v /home/bradswain/testcases/selinux/OSV-2021-270:/testcase -t gcr.io/oss-fuzz-base/base-runner reproduce secilc-fuzzer -runs=100
