Tk Source Code

==18549==ERROR: AddressSanitizer: heap-use-after-free on address 0x61000009e680 at pc 0x000102f77db8 bp 0x7ffeeccc6790 sp 0x7ffeeccc6788
READ of size 4 at 0x61000009e680 thread T0
    #0 0x102f77db7 in MatchPatterns tkBind.c:2824
    #1 0x102f737bf in Tk_BindEvent tkBind.c:2385
    #2 0x102fa91d3 in TkBindEventProc tkCmds.c:319
    #3 0x102fe4669 in Tk_HandleEvent tkEvent.c:1292
    #4 0x102fe7a56 in WindowEventProc tkEvent.c:1723
    #5 0x103bcfbe9 in Tcl_ServiceEvent tclNotify.c:670
    #6 0x103bcff8b in Tcl_DoOneEvent tclNotify.c:903
    #7 0x102fe98dd in Tk_MainLoop tkEvent.c:2109
    #8 0x103054249 in Tk_MainEx tkMain.c:376
    #9 0x102f3dbea in main tkAppInit.c:93
    #10 0x7fff7302dcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

0x61000009e680 is located 64 bytes inside of 192-byte region [0x61000009e640,0x61000009e700)
freed by thread T0 here:
    #0 0x103d452c6 in wrap_free+0xa6 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x492c6)
    #1 0x103a837a4 in TclpFree tclAlloc.c:722
    #2 0x103a9f1fb in Tcl_DbCkfree tclCkalloc.c:653
    #3 0x102f69590 in FreePatSeq tkBind.c:901
    #4 0x102f6eaa3 in DeletePatSeq tkBind.c:1998
    #5 0x102f6dbfe in Tk_DeleteBinding tkBind.c:1764
    #6 0x102fa7f7c in Tk_BindObjCmd tkCmds.c:212
    #7 0x103a934ec in Dispatch tclBasic.c:4467
    #8 0x103a8f804 in TclNRRunCallbacks tclBasic.c:4503
    #9 0x103a8f593 in Tcl_EvalObjv tclBasic.c:4226
    #10 0x103a90de8 in TclEvalEx tclBasic.c:5372
    #11 0x103a90185 in Tcl_EvalEx tclBasic.c:5037
    #12 0x102f76054 in Tk_BindEvent tkBind.c:2602
    #13 0x102fa91d3 in TkBindEventProc tkCmds.c:319
    #14 0x102fe4669 in Tk_HandleEvent tkEvent.c:1292
    #15 0x102fe7a56 in WindowEventProc tkEvent.c:1723
    #16 0x103bcfbe9 in Tcl_ServiceEvent tclNotify.c:670
    #17 0x103bd00fa in Tcl_DoOneEvent tclNotify.c:967
    #18 0x102fe98dd in Tk_MainLoop tkEvent.c:2109
    #19 0x103054249 in Tk_MainEx tkMain.c:376
    #20 0x102f3dbea in main tkAppInit.c:93
    #21 0x7fff7302dcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

previously allocated by thread T0 here:
    #0 0x103d4517d in wrap_malloc+0x9d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4917d)
    #1 0x103a83784 in TclpAlloc tclAlloc.c:699
    #2 0x103a9e96f in Tcl_DbCkalloc tclCkalloc.c:409
    #3 0x103a9f291 in Tcl_DbCkrealloc tclCkalloc.c:695
    #4 0x102f6b4ae in FindSequence tkBind.c:4652
    #5 0x102f6a3d7 in Tk_CreateBinding tkBind.c:1641
    #6 0x102fa80bf in Tk_BindObjCmd tkCmds.c:225
    #7 0x103a934ec in Dispatch tclBasic.c:4467
    #8 0x103a8f804 in TclNRRunCallbacks tclBasic.c:4503
    #9 0x103a91c7f in TclEvalObjEx tclBasic.c:6068
    #10 0x103a8efc9 in Tcl_EvalObjEx tclBasic.c:6049
    #11 0x103c02e76 in AfterProc tclTimer.c:1199
    #12 0x103c01f6d in TclServiceIdle tclTimer.c:751
    #13 0x103bd0128 in Tcl_DoOneEvent tclNotify.c:980
    #14 0x102fe98dd in Tk_MainLoop tkEvent.c:2109
    #15 0x103054249 in Tk_MainEx tkMain.c:376
    #16 0x102f3dbea in main tkAppInit.c:93
    #17 0x7fff7302dcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

SUMMARY: AddressSanitizer: heap-use-after-free tkBind.c:2824 in MatchPatterns
Shadow bytes around the buggy address:
  0x1c2000013c80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x1c2000013c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c2000013ca0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x1c2000013cb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c2000013cc0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x1c2000013cd0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c2000013ce0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x1c2000013cf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c2000013d00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x1c2000013d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x1c2000013d20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==18549==ABORTING
Abort trap: 6