[2019-08-09] - Found with American Fuzzy Lop - CVE-2019-15151 Double free in Cu6mPlayer::~Cu6mPlayer(), in src/u6m.h. ``` ================================================================= ==16659==ERROR: AddressSanitizer: attempting double-free on 0x629000000200 in thread T0: #0 0x4f75a2 in operator delete[](void*) (/home/fcambus/adplay-asan/adplay+0x4f75a2) #1 0x7f96ab794bb7 in Cu6mPlayer::~Cu6mPlayer() /home/fcambus/adplug/./src/u6m.h:42:21 #2 0x7f96ab794bf8 in Cu6mPlayer::~Cu6mPlayer() /home/fcambus/adplug/./src/u6m.h:41:5 #3 0x7f96ab63b66a in CAdPlug::factory(std::__cxx11::basic_string, std::allocator > const&, Copl*, CPlayers const&, CFileProvider const&) /home/fcambus/adplug/src/adplug.cpp:187:2 #4 0x4fcd62 in play(char const*, Player*, int) /home/fcambus/adplay-unix/src/adplay.cc:309:11 #5 0x4fbaf4 in main /home/fcambus/adplay-unix/src/adplay.cc:544:5 #6 0x7f96aae7909a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) #7 0x41f759 in _start (/home/fcambus/adplay-asan/adplay+0x41f759) 0x629000000200 is located 0 bytes inside of 16735-byte region [0x629000000200,0x62900000435f) freed by thread T0 here: #0 0x4f75a2 in operator delete[](void*) (/home/fcambus/adplay-asan/adplay+0x4f75a2) #1 0x7f96ab78d0a9 in Cu6mPlayer::load(std::__cxx11::basic_string, std::allocator > const&, CFileProvider const&) /home/fcambus/adplug/src/u6m.cpp:87:7 #2 0x7f96ab63b5b4 in CAdPlug::factory(std::__cxx11::basic_string, std::allocator > const&, Copl*, CPlayers const&, CFileProvider const&) /home/fcambus/adplug/src/adplug.cpp:182:13 #3 0x4fcd62 in play(char const*, Player*, int) /home/fcambus/adplay-unix/src/adplay.cc:309:11 #4 0x4fbaf4 in main /home/fcambus/adplay-unix/src/adplay.cc:544:5 #5 0x7f96aae7909a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) previously allocated by thread T0 here: #0 0x4f6972 in operator new[](unsigned long) (/home/fcambus/adplay-asan/adplay+0x4f6972) #1 0x7f96ab78cb8d in Cu6mPlayer::load(std::__cxx11::basic_string, std::allocator > const&, CFileProvider const&) /home/fcambus/adplug/src/u6m.cpp:69:15 #2 0x7f96ab63b5b4 in CAdPlug::factory(std::__cxx11::basic_string, std::allocator > const&, Copl*, CPlayers const&, CFileProvider const&) /home/fcambus/adplug/src/adplug.cpp:182:13 #3 0x4fcd62 in play(char const*, Player*, int) /home/fcambus/adplay-unix/src/adplay.cc:309:11 #4 0x4fbaf4 in main /home/fcambus/adplay-unix/src/adplay.cc:544:5 #5 0x7f96aae7909a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) SUMMARY: AddressSanitizer: double-free (/home/fcambus/adplay-asan/adplay+0x4f75a2) in operator delete[](void*) ==16659==ABORTING ```