running commit ce8d4082054519f2eaac39958edde502860a7fc6:
qemu-system-mips -M malta -m 512 \
-kernel vmlinux-3.2.0-4-4kc-malta \
-append 'root=/dev/sda1 console=ttyS0' \
-hda debian_wheezy_mips_standard.qcow2 \
-redir tcp:5556::22 -serial stdio
and connecting with "xtightvncviewer :0" I get when closing vnc:
==27686==ERROR: AddressSanitizer: heap-use-after-free on address
0x63100003c814 at pc 0x55eed918362a bp 0x7ffdf5c36c80 sp 0x7ffdf5c36c78
READ of size 4 at 0x63100003c814 thread T0
#0 0x55eed9183629 in vnc_client_io /source/qemu/ui/vnc.c:1549
#1 0x55eed94ae26c in qio_channel_fd_source_dispatch
/source/qemu/io/channel-watch.c:84
#2 0x7f3e181860f4 in g_main_context_dispatch
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c0f4)
#3 0x55eed95b9799 in glib_pollfds_poll /source/qemu/util/main-loop.c:215
#4 0x55eed95b9989 in os_host_main_loop_wait
/source/qemu/util/main-loop.c:263
#5 0x55eed95b9b5f in main_loop_wait /source/qemu/util/main-loop.c:522
#6 0x55eed898f7dd in main_loop /source/qemu/vl.c:1943
#7 0x55eed89a1f0b in main /source/qemu/vl.c:4734
#8 0x7f3dfe094a86 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21a86)
#9 0x55eed8518db9 in _start
(/build/qemu/mips-softmmu/qemu-system-mips+0x14f3db9)
0x63100003c814 is located 20 bytes inside of 75744-byte region
[0x63100003c800,0x63100004efe0)
freed by thread T0 here:
#0 0x7f3e18b878c8 in __interceptor_free
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd98c8)
#1 0x55eed9181bb0 in vnc_disconnect_finish /source/qemu/ui/vnc.c:1278
#2 0x55eed9183225 in vnc_client_read /source/qemu/ui/vnc.c:1511
#3 0x55eed91835a9 in vnc_client_io /source/qemu/ui/vnc.c:1541
#4 0x55eed94ae26c in qio_channel_fd_source_dispatch
/source/qemu/io/channel-watch.c:84
#5 0x7f3e181860f4 in g_main_context_dispatch
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c0f4)
previously allocated by thread T0 here:
#0 0x7f3e18b87df8 in calloc
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9df8)
#1 0x7f3e1818b8b0 in g_malloc0
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x518b0)
#2 0x55eed9192aa0 in vnc_listen_io /source/qemu/ui/vnc.c:3186
#3 0x55eed94b9fd7 in qio_net_listener_channel_func
/source/qemu/io/net-listener.c:57
#4 0x55eed94ae26c in qio_channel_fd_source_dispatch
/source/qemu/io/channel-watch.c:84
#5 0x7f3e181860f4 in g_main_context_dispatch
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c0f4)
SUMMARY: AddressSanitizer: heap-use-after-free
/source/qemu/ui/vnc.c:1549 in vnc_client_io
Shadow bytes around the buggy address:
0x0c627ffff8b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627ffff8c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627ffff8d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627ffff8e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627ffff8f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c627ffff900: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c627ffff910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c627ffff920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c627ffff930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c627ffff940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c627ffff950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Heap left redzone: fa
Freed heap region: fd
==26606==ABORTING
