Description

Heap use after free in op_is_set_bp function.

ASAN report：

=================================================================
==2367298==ERROR: AddressSanitizer: heap-use-after-free on address 0x6060000481a0 at pc 0x7f580c10da41 bp 0x7ffd53a17ed0 sp 0x7ffd53a17ec0
READ of size 8 at 0x6060000481a0 thread T0
    #0 0x7f580c10da40 in op_is_set_bp /root/radare2/libr/anal/fcn.c:524
    #1 0x7f580c11f8c7 in fcn_recurse /root/radare2/libr/anal/fcn.c:1385
    #2 0x7f580c1211bf in r_anal_function_bb /root/radare2/libr/anal/fcn.c:1439
    #3 0x7f580c122e61 in r_anal_function /root/radare2/libr/anal/fcn.c:1554
    #4 0x7f5813218c7a in __core_anal_fcn /root/radare2/libr/core/canal.c:797
    #5 0x7f581322b973 in r_core_anal_fcn /root/radare2/libr/core/canal.c:2024
    #6 0x7f5812ebff90 in r_core_af /root/radare2/libr/core/cmd_anal.c:3861
    #7 0x7f581324958d in r_core_anal_all /root/radare2/libr/core/canal.c:4270
    #8 0x7f5812f2b8bd in cmd_anal_all /root/radare2/libr/core/cmd_anal.c:11070
    #9 0x7f5812f39639 in cmd_anal /root/radare2/libr/core/cmd_anal.c:12223
    #10 0x7f58131fa1c4 in r_cmd_call /root/radare2/libr/core/cmd_api.c:537
    #11 0x7f5813079b67 in r_core_cmd_subst_i /root/radare2/libr/core/cmd.c:4478
    #12 0x7f5813069a46 in r_core_cmd_subst /root/radare2/libr/core/cmd.c:3364
    #13 0x7f58130863a3 in run_cmd_depth /root/radare2/libr/core/cmd.c:5366
    #14 0x7f581308741a in r_core_cmd /root/radare2/libr/core/cmd.c:5449
    #15 0x7f5813088413 in r_core_cmd0 /root/radare2/libr/core/cmd.c:5606
    #16 0x7f581bb2c1d1 in r_main_radare2 /root/radare2/libr/main/radare2.c:1394
    #17 0x55e8ee37b937 in main /root/radare2/binr/radare2/radare2.c:96
    #18 0x7f581af2c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #19 0x55e8ee37b30d in _start (/root/radare2/binr/radare2/radare2+0x230d)

0x6060000481a0 is located 0 bytes inside of 56-byte region [0x6060000481a0,0x6060000481d8)
freed by thread T0 here:
    #0 0x7f581cc7940f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x7f58081c67de in r_reg_item_free /root/radare2/libr/reg/reg.c:96
    #2 0x7f581c16b32e in r_list_delete /root/radare2/libr/util/list.c:124
    #3 0x7f581c16ade1 in r_list_purge /root/radare2/libr/util/list.c:90
    #4 0x7f581c16afb7 in r_list_free /root/radare2/libr/util/list.c:100
    #5 0x7f58081c7c69 in r_reg_free_internal /root/radare2/libr/reg/reg.c:188
    #6 0x7f58081e099e in r_reg_set_profile_string /root/radare2/libr/reg/profile.c:150
    #7 0x7f580c19dded in r_anal_set_reg_profile /root/radare2/libr/anal/anal.c:258
    #8 0x7f580c19e663 in r_anal_set_bits /root/radare2/libr/anal/anal.c:324
    #9 0x7f58130a7fbc in cb_asmbits /root/radare2/libr/core/cconfig.c:884
    #10 0x7f581ad45ad7 in r_config_set_i /root/radare2/libr/config/config.c:574
    #11 0x7f5813128320 in r_core_seek_arch_bits /root/radare2/libr/core/cio.c:377
    #12 0x7f5812d4abed in archbits /root/radare2/libr/core/core.c:267
    #13 0x7f580c1014cf in r_anal_op /root/radare2/libr/anal/op.c:110
    #14 0x7f580c108703 in is_delta_pointer_table /root/radare2/libr/anal/fcn.c:195
    #15 0x7f580c116a37 in fcn_recurse /root/radare2/libr/anal/fcn.c:988
    #16 0x7f580c1211bf in r_anal_function_bb /root/radare2/libr/anal/fcn.c:1439
    #17 0x7f580c122e61 in r_anal_function /root/radare2/libr/anal/fcn.c:1554
    #18 0x7f5813218c7a in __core_anal_fcn /root/radare2/libr/core/canal.c:797
    #19 0x7f581322b973 in r_core_anal_fcn /root/radare2/libr/core/canal.c:2024
    #20 0x7f5812ebff90 in r_core_af /root/radare2/libr/core/cmd_anal.c:3861
    #21 0x7f581324958d in r_core_anal_all /root/radare2/libr/core/canal.c:4270
    #22 0x7f5812f2b8bd in cmd_anal_all /root/radare2/libr/core/cmd_anal.c:11070
    #23 0x7f5812f39639 in cmd_anal /root/radare2/libr/core/cmd_anal.c:12223
    #24 0x7f58131fa1c4 in r_cmd_call /root/radare2/libr/core/cmd_api.c:537
    #25 0x7f5813079b67 in r_core_cmd_subst_i /root/radare2/libr/core/cmd.c:4478
    #26 0x7f5813069a46 in r_core_cmd_subst /root/radare2/libr/core/cmd.c:3364
    #27 0x7f58130863a3 in run_cmd_depth /root/radare2/libr/core/cmd.c:5366
    #28 0x7f581308741a in r_core_cmd /root/radare2/libr/core/cmd.c:5449
    #29 0x7f5813088413 in r_core_cmd0 /root/radare2/libr/core/cmd.c:5606

previously allocated by thread T0 here:
    #0 0x7f581cc79a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
    #1 0x7f58081dec7b in parse_def /root/radare2/libr/reg/profile.c:68
    #2 0x7f58081e199b in r_reg_set_profile_string /root/radare2/libr/reg/profile.c:221
    #3 0x7f580c19dded in r_anal_set_reg_profile /root/radare2/libr/anal/anal.c:258
    #4 0x7f580c19e663 in r_anal_set_bits /root/radare2/libr/anal/anal.c:324
    #5 0x7f58130a7fbc in cb_asmbits /root/radare2/libr/core/cconfig.c:884
    #6 0x7f581ad45ad7 in r_config_set_i /root/radare2/libr/config/config.c:574
    #7 0x7f5813128320 in r_core_seek_arch_bits /root/radare2/libr/core/cio.c:377
    #8 0x7f581322afb6 in r_core_anal_fcn /root/radare2/libr/core/canal.c:1973
    #9 0x7f5812ebff90 in r_core_af /root/radare2/libr/core/cmd_anal.c:3861
    #10 0x7f581324958d in r_core_anal_all /root/radare2/libr/core/canal.c:4270
    #11 0x7f5812f2b8bd in cmd_anal_all /root/radare2/libr/core/cmd_anal.c:11070
    #12 0x7f5812f39639 in cmd_anal /root/radare2/libr/core/cmd_anal.c:12223
    #13 0x7f58131fa1c4 in r_cmd_call /root/radare2/libr/core/cmd_api.c:537
    #14 0x7f5813079b67 in r_core_cmd_subst_i /root/radare2/libr/core/cmd.c:4478
    #15 0x7f5813069a46 in r_core_cmd_subst /root/radare2/libr/core/cmd.c:3364
    #16 0x7f58130863a3 in run_cmd_depth /root/radare2/libr/core/cmd.c:5366
    #17 0x7f581308741a in r_core_cmd /root/radare2/libr/core/cmd.c:5449
    #18 0x7f5813088413 in r_core_cmd0 /root/radare2/libr/core/cmd.c:5606
    #19 0x7f581bb2c1d1 in r_main_radare2 /root/radare2/libr/main/radare2.c:1394
    #20 0x55e8ee37b937 in main /root/radare2/binr/radare2/radare2.c:96
    #21 0x7f581af2c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)

SUMMARY: AddressSanitizer: heap-use-after-free /root/radare2/libr/anal/fcn.c:524 in op_is_set_bp
Shadow bytes around the buggy address:
  0x0c0c80000fe0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c80000ff0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c80001000: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c80001010: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c80001020: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
=>0x0c0c80001030: fa fa fa fa[fd]fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c80001040: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c80001050: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c80001060: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c80001070: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c80001080: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2367298==ABORTING

How can we reproduce the issue?

Compile command

./sys/sanitize.sh

reproduce command

tests_65185.zip

unzip tests_65185.zip
./radare2 -qq -AA <poc_file>

Impact

latest commit and latest release

$ ./radare2 -v
radare2 5.6.5 27830 @ linux-x86-64 git.5.6.2
commit: 245babbf9e0d45574ee24f1b77b6ca28379dcb14 build: 2022-03-18__07:41:56
$ cat /etc/issue
Ubuntu 20.04.3 LTS \n \l