{"action":"created","issue":{"url":"https://api.github.com/repos/monkey/monkey/issues/214","labels_url":"https://api.github.com/repos/monkey/monkey/issues/214/labels{/name}","comments_url":"https://api.github.com/repos/monkey/monkey/issues/214/comments","events_url":"https://api.github.com/repos/monkey/monkey/issues/214/events","html_url":"https://github.com/monkey/monkey/issues/214","id":100544909,"number":214,"title":"FastCGI: crashes as backend behind nghttpx, and possible global-buffer-overflow","user":{"login":"0x64616E69656C","id":7055311,"avatar_url":"https://avatars.githubusercontent.com/u/7055311?v=3","gravatar_id":"","url":"https://api.github.com/users/0x64616E69656C","html_url":"https://github.com/0x64616E69656C","followers_url":"https://api.github.com/users/0x64616E69656C/followers","following_url":"https://api.github.com/users/0x64616E69656C/following{/other_user}","gists_url":"https://api.github.com/users/0x64616E69656C/gists{/gist_id}","starred_url":"https://api.github.com/users/0x64616E69656C/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0x64616E69656C/subscriptions","organizations_url":"https://api.github.com/users/0x64616E69656C/orgs","repos_url":"https://api.github.com/users/0x64616E69656C/repos","events_url":"https://api.github.com/users/0x64616E69656C/events{/privacy}","received_events_url":"https://api.github.com/users/0x64616E69656C/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"edsiper","id":369718,"avatar_url":"https://avatars.githubusercontent.com/u/369718?v=3","gravatar_id":"","url":"https://api.github.com/users/edsiper","html_url":"https://github.com/edsiper","followers_url":"https://api.github.com/users/edsiper/followers","following_url":"https://api.github.com/users/edsiper/following{/other_user}","gists_url":"https://api.github.com/users/edsiper/gists{/gist_id}","starred_url":"https://api.github.com/users/edsiper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edsiper/subscriptions","organizations_url":"https://api.github.com/users/edsiper/orgs","repos_url":"https://api.github.com/users/edsiper/repos","events_url":"https://api.github.com/users/edsiper/events{/privacy}","received_events_url":"https://api.github.com/users/edsiper/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-08-12T13:35:41Z","updated_at":"2015-08-13T08:05:09Z","closed_at":null,"body":"Hi,\r\n\r\nI'm was looking for a replacement for nginx and wanted to give monkey a try as a backend for nghttpx to serve static files & content (hugo), and as a fastcgi proxy for .hh/.php (pass to HHVM via 127.0.0.1:9001).\r\n\r\n**Default installation (gcc-4.9.3):**\r\n\r\n```\r\n./configure --prefix=/opt/afl/monkey-1.6.0-default\r\nmake\r\nsudo make install\r\n```\r\n\r\nAfter copying etc/monkey to /usr/local/etc/monkey and making a few adjustments to make it work:\r\n\r\n> curl localhost:2001\r\n> OK: Hello World.\r\n\r\n> curl localhost:2001/index.html\r\n> OK: Hello World\r\n\r\n> curl localhost:2001/test.php\r\n\r\n```\r\n[2015/08/12 15:27:04] [  Error] Segmentation fault (11), code=1, addr=0x7f7bf7ffffb0\r\n```\r\n\r\n_Restarting monkey._\r\n\r\n> curl https://myssite\r\n> OK: Hello World.\r\n> curl https://mysite/index.html\r\n> OK: Hello World.\r\n\r\n> curl https://mysite/test.php\r\n\r\n```\r\nIOV_IDX=50 > IO_SIZE=49\r\n\r\n[index=0 len=16]\r\n'[end=16]\r\n\r\n[index=1 len=10]\r\n'\r\n'[end=10]\r\n\r\n[index=2 len=15]\r\n'SERVER_SOFTWARE'[end=15]\r\n\r\n[index=3 len=12]\r\n'Monkey/1.6.0'[end=12]\r\n\r\n[index=4 len=10]\r\n'#\r\n  '[end=10]\r\n\r\n[index=5 len=11]\r\n'SERVER_NAME'[end=11]\r\n\r\n[index=6 len=22]\r\n'mysite'[end=22]\r\n\r\n[index=7 len=10]\r\n'[end=10]\r\n\r\n[index=8 len=13]\r\n'DOCUMENT_ROOT'[end=13]\r\n\r\n[index=9 len=13]\r\n'/var/www/html'[end=13]\r\n\r\n[index=10 len=10]\r\n'\r\n        '[end=10]\r\n\r\n[index=11 len=11]\r\n'SERVER_ADDR'[end=11]\r\n\r\n[index=12 len=9]\r\n'127.0.0.1'[end=9]\r\n\r\n[index=13 len=10]\r\n'\r\n '[end=10]\r\n\r\n[index=14 len=11]\r\n'SERVER_PORT'[end=11]\r\n\r\n[index=15 len=4]\r\n'2001'[end=4]\r\n\r\n[index=16 len=10]\r\n'\r\n        '[end=10]\r\n\r\n[index=17 len=11]\r\n'REMOTE_ADDR'[end=11]\r\n\r\n[index=18 len=9]\r\n'127.0.0.1'[end=9]\r\n\r\n[index=19 len=10]\r\n'\r\n '[end=10]\r\n\r\n[index=20 len=11]\r\n'REMOTE_PORT'[end=11]\r\n\r\n[index=21 len=5]\r\n'55939'[end=5]\r\n\r\n[index=22 len=10]\r\n'''[end=10]\r\n\r\n[index=23 len=15]\r\n'SCRIPT_FILENAME'[end=15]\r\n\r\n[index=24 len=22]\r\n'/var/www/html/test.php'[end=22]\r\n\r\n[index=25 len=10]\r\n'\r\n        '[end=10]\r\n\r\n[index=26 len=11]\r\n'SCRIPT_NAME'[end=11]\r\n\r\n[index=27 len=9]\r\n'/test.php'[end=9]\r\n\r\n[index=28 len=10]\r\n''[end=10]\r\n\r\n[index=29 len=14]\r\n'REQUEST_METHOD'[end=14]\r\n\r\n[index=30 len=3]\r\n'GET'[end=3]\r\n\r\n[index=31 len=10]\r\n'\r\n        '[end=10]\r\n\r\n[index=32 len=11]\r\n'REQUEST_URI'[end=11]\r\n\r\n[index=33 len=9]\r\n'/test.php'[end=9]\r\n\r\n[index=34 len=10]\r\n'!      '[end=10]\r\n\r\n[index=35 len=9]\r\n'HTTP_HOST'[end=9]\r\n\r\n[index=36 len=22]\r\n'mysite'[end=22]\r\n\r\n[index=37 len=10]\r\n'\r\n '[end=10]\r\n\r\n[index=38 len=15]\r\n'HTTP_USER_AGENT'[end=15]\r\n\r\n[index=39 len=11]\r\n'curl/7.43.0'[end=11]\r\n\r\n[index=40 len=10]\r\n'\r\n '[end=10]\r\n\r\n[index=41 len=11]\r\n'HTTP_ACCEPT'[end=11]\r\n\r\n[index=42 len=3]\r\n'*/*'[end=3]\r\n\r\n[index=43 len=10]\r\n'$'[end=10]\r\n\r\n[index=44 len=20]\r\n'HTTP_X_FORWARDED_FOR'[end=20]\r\n\r\n[index=45 len=14]\r\n'82.100.217.163'[end=14]\r\n\r\n[index=46 len=10]\r\n''[end=10]\r\n\r\n[index=47 len=22]\r\n'HTTP_X_FORWARDED_PROTO'[end=22]\r\n\r\n[index=48 len=5]\r\n'https'[end=5]\r\n\r\n[index=49 len=10]\r\n'\r\n'[end=10]\r\n[2015/08/12 15:29:20] [  BUG !] Bug found in mk_iov_add() at /home/daniel/code/monkey/monkey-1.6.0/./mk_core/include/mk_iov.h:130\r\n```\r\n\r\n\r\n---\r\n**Ok, time to play:**\r\n\r\nRebuild with AFL 1.83b / clang 3.5.2:\r\n```\r\nCFLAGS=\"-D_FORTIFY_SOURCE=2 \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -Wformat -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all -fPIE -fPIC \\\r\n        -fsanitize=address,undefined \\\r\n        -Werror=array-bounds -Warray-bounds \\\r\n        -Wstrict-prototypes -Wpointer-type-mismatch \\\r\n        -Wreorder -Wpointer-sign -Wsign-compare\" \\\r\nCXXFLAGS=\"-D_FORTIFY_SOURCE=2 \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -format -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all -fPIE -fPIC \\\r\n        -fsanitize=address,undefined \\\r\n        -Werror=array-bounds -Warray-bounds \\\r\n        -Wstrict-prototypes -Wpointer-type-mismatch \\\r\n        -Wreorder -Wpointer-sign -Wsign-compare\" \\\r\nLDFLAGS=\"-Wl,-z,relro -Wl,-z,now \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -fPIE -fPIC -pie \\\r\n        -Wformat -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all \\\r\n        -fsanitize=address,undefined \\\r\n        -Wreorder -Wsign-compare \\\r\n        -all-static\" \\\r\nCC=\"afl-clang\" \\\r\nCXX=\"afl-clang++\" \\\r\n./configure \\\r\n--prefix=/opt/afl/monkey-1.6.0-clang\r\n\r\nAFL_HARDEN=1 AFL_USE_ASAN=1 make\r\n\r\nsudo make install\r\n```\r\n\r\nNow starting monkey:\r\n```\r\n/opt/afl/monkey-1.6.0-clang/sbin > sudo ./monkey -c /usr/local/etc/monkey\r\nMonkey HTTP Server v1.6.0\r\nBuilt : Aug 12 2015 15:15:56 (/usr/bin/afl-clang 4.2.1)\r\nHome  : http://monkey-project.com\r\n[+] Process ID is 21115\r\n[+] Server listening on 127.0.0.1:2001\r\n[+] 16 threads, may handle up to 1024 client connections\r\n[+] Loaded Plugins: liana fastcgi\r\n[+] Linux Features: TCP_FASTOPEN SO_REUSEPORT\r\n```\r\n\r\n\r\n> curl localhost:2001\r\n> OK: Hello World\r\n\r\n> curl localhost:2001/index.html\r\n\r\n```\r\n/home/daniel/code/monkey/monkey-1.6.0/mk_server/mk_utils.c:360:22: runtime error: load of misaligned address 0x7f04704463fd for type 'uint32_t' (aka 'unsigned int'), which requires 4 byte alignment\r\n0x7f04704463fd: note: pointer points here\r\n 68 74 6d 6c 2f 69 6e  64 65 78 2e 68 74 6d 6c  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00\r\n             ^\r\n```\r\n\r\n> curl localhost:2001/index.php\r\n\r\n```\r\n <excpected output from print_r($_SERVER)>\r\n```\r\n\r\n> curl https://mysite/test.php (via nghttpx as TLS offloader with 127.0.0.1:2001 as it's backend)\r\n\r\n```\r\n/home/daniel/code/monkey/monkey-1.6.0/mk_server/mk_http_parser.c:196:14: runtime error: index -1 out of bounds for type 'struct row_entry [19]'\r\n=================================================================\r\n==21115==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f04840eb87c at pc 0x7f0483db9284 bp 0x7f0476ff23f0 sp 0x7f0476ff23e8\r\nREAD of size 4 at 0x7f04840eb87c thread T13 (monkey: wrk/12)\r\n    #0 0x7f0483db9283 (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x187283)\r\n    #1 0x7f0483da49c7 (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x1729c7)\r\n    #2 0x7f0483d9b2f4 (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x1692f4)\r\n    #3 0x7f0483d65c47 (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x133c47)\r\n    #4 0x7f0483dce846 (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x19c846)\r\n    #5 0x7f0483d61c01 (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x12fc01)\r\n    #6 0x7f04835f60a3 (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3)\r\n    #7 0x7f0482c0c07c (/lib/x86_64-linux-gnu/libc.so.6+0xe607c)\r\n\r\n0x7f04840eb87c is located 36 bytes to the left of global variable 'mk_headers_table' defined in '/home/daniel/code/monkey/monkey-1.6.0/mk_server/mk_http_parser.c:58:18' (0x7f04840eb8a0) of size 684\r\n0x7f04840eb87c is located 4 bytes to the right of global variable 'mk_methods_table' defined in '/home/daniel/code/monkey/monkey-1.6.0/mk_server/mk_http_parser.c:49:18' (0x7f04840eb7a0) of size 216\r\nSUMMARY: AddressSanitizer: global-buffer-overflow ??:0 ??\r\nShadow bytes around the buggy address:\r\n  0x0fe1108156b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe1108156c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe1108156d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe1108156e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe1108156f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x0fe110815700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[f9]\r\n  0x0fe110815710: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe110815720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe110815730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe110815740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0fe110815750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07\r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  ASan internal:           fe\r\nThread T13 (monkey: wrk/12) created by T0 (monkey: server) here:\r\n    #0 0x7f0483d0d49f (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0xdb49f)\r\n    #1 0x7f0483d62bac (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x130bac)\r\n    #2 0x7f0483dc9b71 (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x197b71)\r\n    #3 0x7f0483d4849a (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x11649a)\r\n    #4 0x7f0483d44b4e (/opt/afl/monkey-1.6.0-clang/sbin/monkey+0x112b4e)\r\n    #5 0x7f0482b47b44 (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)\r\n\r\n==21115==ABORTING\r\n```\r\n\r\n\r\nThen I tried GCC:\r\n\r\n```\r\nCFLAGS=\"-D_FORTIFY_SOURCE=2 \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -Wformat -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all -fPIE -fPIC \\\r\n        -fsanitize=address,undefined \\\r\n        -Werror=array-bounds -Warray-bounds \\\r\n        -Wsign-compare -Wpointer-sign\" \\\r\nCXXFLAGS=\"-D_FORTIFY_SOURCE=2 \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -Wformat -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all -fPIE -fPIC \\\r\n        -fsanitize=address,undefined \\\r\n        -Werror=array-bounds -Warray-bounds \\\r\n        -Wreorder -Wsign-compare\" \\\r\nLDFLAGS=\"-Wl,-z,relro -Wl,-z,now \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -fPIE -fPIC -pie \\\r\n        -Wformat -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all \\\r\n        -fsanitize=address,undefined \\\r\n        -Wreorder -Wsign-compare\" \\\r\nCC=\"afl-gcc\" \\\r\nCXX=\"afl-g++\" \\\r\n./configure \\\r\n--prefix=/opt/afl/monkey-1.6.0-gcc\r\n\r\nAFL_HARDEN=1 AFL_USE_ASAN=1 make\r\n```\r\n\r\nbuild fails:\r\n```\r\nLinking C executable monkey\r\nafl-cc 1.83b by <lcamtuf@google.com>\r\n/usr/bin/ld.bfd.real: ../mk_server/libmonkey.a(mk_scheduler.c.o): TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF against `cs_incomplete' at 0x58f in section `.text' failed\r\n../mk_server/libmonkey.a: error adding symbols: Bad value\r\ncollect2: error: ld returned 1 exit status\r\nmk_bin/CMakeFiles/monkey-bin.dir/build.make:114: recipe for target 'mk_bin/monkey' failed\r\nmake[3]: *** [mk_bin/monkey] Error 1\r\nmake[3]: Leaving directory '/home/daniel/code/monkey/monkey-1.6.0/build'\r\nCMakeFiles/Makefile2:788: recipe for target 'mk_bin/CMakeFiles/monkey-bin.dir/all' failed\r\nmake[2]: *** [mk_bin/CMakeFiles/monkey-bin.dir/all] Error 2\r\nmake[2]: Leaving directory '/home/daniel/code/monkey/monkey-1.6.0/build'\r\nMakefile:116: recipe for target 'all' failed\r\nmake[1]: *** [all] Error 2\r\nmake[1]: Leaving directory '/home/daniel/code/monkey/monkey-1.6.0/build'\r\nMakefile:2: recipe for target 'all' failed\r\nmake: *** [all] Error 2\r\n```\r\n\r\n\r\nIt was impossible to build monkey with custom FLAGS, I even tried cutting everything down to CXX-/CFLAGS=\"-fsanitize-address,unknown\" ./configure but no luck.\r\nI also tried using --malloc-libc and --pthread-tls."},"comment":{"url":"https://api.github.com/repos/monkey/monkey/issues/comments/130569686","html_url":"https://github.com/monkey/monkey/issues/214#issuecomment-130569686","issue_url":"https://api.github.com/repos/monkey/monkey/issues/214","id":130569686,"user":{"login":"0x64616E69656C","id":7055311,"avatar_url":"https://avatars.githubusercontent.com/u/7055311?v=3","gravatar_id":"","url":"https://api.github.com/users/0x64616E69656C","html_url":"https://github.com/0x64616E69656C","followers_url":"https://api.github.com/users/0x64616E69656C/followers","following_url":"https://api.github.com/users/0x64616E69656C/following{/other_user}","gists_url":"https://api.github.com/users/0x64616E69656C/gists{/gist_id}","starred_url":"https://api.github.com/users/0x64616E69656C/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0x64616E69656C/subscriptions","organizations_url":"https://api.github.com/users/0x64616E69656C/orgs","repos_url":"https://api.github.com/users/0x64616E69656C/repos","events_url":"https://api.github.com/users/0x64616E69656C/events{/privacy}","received_events_url":"https://api.github.com/users/0x64616E69656C/received_events","type":"User","site_admin":false},"created_at":"2015-08-13T08:05:09Z","updated_at":"2015-08-13T08:05:09Z","body":"### Finally, custom build with gcc 4.9.3 went through:\r\n\r\n```\r\nCFLAGS=\"-D_FORTIFY_SOURCE=2 \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -Wformat -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all -fPIE -fPIC \\\r\n        -Werror=array-bounds -Warray-bounds \\\r\n        -std=gnu99 -pipe -funroll-loops \\\r\n        -Wsign-compare -Wpointer-sign\" \\\r\nLDFLAGS=\"-Wl,-z,relro -Wl,-z,now \\\r\n        -O0 -g3 -fno-omit-frame-pointer \\\r\n        -fPIE -fPIC -pie \\\r\n        -Wformat -Wformat-security -Werror=format-security \\\r\n        -fstack-protector-all \\\r\n        -Wreorder -Wsign-compare -lm -lpthread -pthread\" \\\r\nLIBS=\"-lpthread\" \\\r\nCC=\"gcc\" \\\r\n./configure \\\r\n        --prefix=/opt/afl/monkey-1.6.0-gcc\r\nmake\r\nsudo make install\r\n```\r\n\r\n```\r\n/opt/afl/monkey-1.6.0-gcc/sbin > sudo ./monkey -c /usr/local/etc/monkey\r\nMonkey HTTP Server v1.6.0\r\nBuilt : Aug 13 2015 09:00:34 (/usr/bin/gcc 4.9.3)\r\nHome  : http://monkey-project.com\r\n[+] Process ID is 23193\r\n[+] Server listening on 127.0.0.1:2001\r\n[+] 16 threads, may handle up to 1024 client connections\r\n[+] Loaded Plugins: liana fastcgi\r\n[+] Linux Features: TCP_FASTOPEN SO_REUSEPORT\r\n[2015/08/13 09:02:17] [   Info] HTTP Server started\r\n```\r\n\r\n> curl localhost:2001[/|/index.html]\r\n> OK: Hello World.\r\n\r\n> curl https://my.host.name[/|/index.html]\r\n> OK: Hello World.\r\n\r\n> curl https://my.host.name/test.php\r\n> [2015/08/13 09:38:19] [  BUG !] Bug found in mk_iov_add() at /home/daniel/code/monkey/monkey-1.6.0/./mk_core/include/mk_iov.h:130\r\n\r\n**Sent headers**\r\n```\r\nUser-Agent: curl/7.43.0\r\nX-Forwarded-For: <public ip>\r\nHost: <redacted.host.name>\r\nAccept: */*\r\nX-Forwarded-Proto: https\r\nVia: 1.1 nghttpx\r\nScheme: http\r\nReturn-Code: 200\r\n```\r\n\r\n> curl localhost:2001/test.php\r\n> **[2015/08/13 09:37:44] [  Error] Segmentation fault (11), code=2, addr=0x7faa07ffffb0**\r\n\r\n\r\n#### restart with valgrind\r\n\r\n```\r\n/opt/afl/monkey-1.6.0-gcc/sbin > sudo valgrind ./monkey -c /usr/local/etc/monkey\r\n==7605== Memcheck, a memory error detector\r\n==7605== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\r\n==7605== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info\r\n==7605== Command: ./monkey -c /usr/local/etc/monkey\r\n==7605==\r\nMonkey HTTP Server v1.6.0\r\nBuilt : Aug 13 2015 09:35:08 (/usr/bin/gcc 4.9.3)\r\nHome  : http://monkey-project.com\r\n[+] Process ID is 7605\r\n[+] Server listening on 127.0.0.1:2001\r\n[+] 16 threads, may handle up to 1024 client connections\r\n[+] Loaded Plugins: liana fastcgi\r\n[+] Linux Features: TCP_FASTOPEN SO_REUSEPORT\r\n[2015/08/13 09:39:26] [   Info] HTTP Server started\r\n```\r\n\r\n> curl localhost:2001/test.php\r\n\r\n```\r\n==7605== Thread 8 monkey: wrk/5:\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x130574: je_arena_mapp_get (arena.h:511)\r\n==7605==    by 0x130574: je_arena_mapbitsp_get (arena.h:518)\r\n==7605==    by 0x130574: je_arena_mapbits_get (arena.h:532)\r\n==7605==    by 0x130574: je_arena_mapbits_binind_get (arena.h:573)\r\n==7605==    by 0x130574: je_arena_salloc (arena.h:991)\r\n==7605==    by 0x130574: je_isalloc (jemalloc_internal.h:849)\r\n==7605==    by 0x130574: ifree (jemalloc.c:1228)\r\n==7605==    by 0x130574: je_free (jemalloc.c:1308)\r\n==7605==    by 0x125D04: mk_mem_free (mk_memory.h:96)\r\n==7605==    by 0x126206: mk_iov_free_marked (mk_iov.c:143)\r\n==7605==    by 0x12618F: mk_iov_free (mk_iov.c:126)\r\n==7605==    by 0x5903068: fcgi_exit (fcgi_handler.c:404)\r\n==7605==    by 0x5903524: cb_fastcgi_on_read (fcgi_handler.c:520)\r\n==7605==    by 0x11DD9D: mk_server_worker_loop (mk_server.c:455)\r\n==7605==    by 0x1158E6: mk_sched_launch_worker_loop (mk_scheduler.c:394)\r\n==7605==    by 0x513E0A3: start_thread (pthread_create.c:309)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x13083C: je_arena_mapp_get (arena.h:511)\r\n==7605==    by 0x13083C: je_arena_mapbitsp_get (arena.h:518)\r\n==7605==    by 0x13083C: je_arena_mapbits_get (arena.h:532)\r\n==7605==    by 0x13083C: je_arena_mapbits_binind_get (arena.h:573)\r\n==7605==    by 0x13083C: je_arena_salloc (arena.h:991)\r\n==7605==    by 0x13083C: je_isalloc (jemalloc_internal.h:849)\r\n==7605==    by 0x13083C: je_p2rz (jemalloc_internal.h:884)\r\n==7605==    by 0x13083C: ifree (jemalloc.c:1232)\r\n==7605==    by 0x13083C: je_free (jemalloc.c:1308)\r\n==7605==    by 0x125D04: mk_mem_free (mk_memory.h:96)\r\n==7605==    by 0x126206: mk_iov_free_marked (mk_iov.c:143)\r\n==7605==    by 0x12618F: mk_iov_free (mk_iov.c:126)\r\n==7605==    by 0x5903068: fcgi_exit (fcgi_handler.c:404)\r\n==7605==    by 0x5903524: cb_fastcgi_on_read (fcgi_handler.c:520)\r\n==7605==    by 0x11DD9D: mk_server_worker_loop (mk_server.c:455)\r\n==7605==    by 0x1158E6: mk_sched_launch_worker_loop (mk_scheduler.c:394)\r\n==7605==    by 0x513E0A3: start_thread (pthread_create.c:309)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x15A51B: je_arena_mapp_get (arena.h:511)\r\n==7605==    by 0x15A51B: je_arena_mapbitsp_get (arena.h:518)\r\n==7605==    by 0x15A51B: je_arena_mapbits_get (arena.h:532)\r\n==7605==    by 0x15A51B: je_arena_mapbits_binind_get (arena.h:573)\r\n==7605==    by 0x15A51B: je_arena_salloc (arena.h:991)\r\n==7605==    by 0x15A51B: je_isalloc (jemalloc_internal.h:849)\r\n==7605==    by 0x15A51B: je_quarantine (quarantine.c:103)\r\n==7605==    by 0x1306C7: je_iqalloct (jemalloc_internal.h:915)\r\n==7605==    by 0x1306C7: je_iqalloc (jemalloc_internal.h:924)\r\n==7605==    by 0x1306C7: ifree (jemalloc.c:1233)\r\n==7605==    by 0x1306C7: je_free (jemalloc.c:1308)\r\n==7605==    by 0x125D04: mk_mem_free (mk_memory.h:96)\r\n==7605==    by 0x126206: mk_iov_free_marked (mk_iov.c:143)\r\n==7605==    by 0x12618F: mk_iov_free (mk_iov.c:126)\r\n==7605==    by 0x5903068: fcgi_exit (fcgi_handler.c:404)\r\n==7605==    by 0x5903524: cb_fastcgi_on_read (fcgi_handler.c:520)\r\n==7605==    by 0x11DD9D: mk_server_worker_loop (mk_server.c:455)\r\n==7605==    by 0x1158E6: mk_sched_launch_worker_loop (mk_scheduler.c:394)\r\n==7605==    by 0x513E0A3: start_thread (pthread_create.c:309)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Mismatched free() / delete / delete []\r\n==7605==    at 0x130719: ifree (jemalloc.c:1234)\r\n==7605==    by 0x130719: je_free (jemalloc.c:1308)\r\n==7605==    by 0x125D04: mk_mem_free (mk_memory.h:96)\r\n==7605==    by 0x126206: mk_iov_free_marked (mk_iov.c:143)\r\n==7605==    by 0x12618F: mk_iov_free (mk_iov.c:126)\r\n==7605==    by 0x5903068: fcgi_exit (fcgi_handler.c:404)\r\n==7605==    by 0x5903524: cb_fastcgi_on_read (fcgi_handler.c:520)\r\n==7605==    by 0x11DD9D: mk_server_worker_loop (mk_server.c:455)\r\n==7605==    by 0x1158E6: mk_sched_launch_worker_loop (mk_scheduler.c:394)\r\n==7605==    by 0x513E0A3: start_thread (pthread_create.c:309)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6414ea0 is 0 bytes inside a block of size 10 alloc'd\r\n==7605==    at 0x4C28C20: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55D89E9: strdup (strdup.c:42)\r\n==7605==    by 0x590257B: fcgi_add_param_net (fcgi_handler.c:177)\r\n==7605==    by 0x5902A75: fcgi_encode_request (fcgi_handler.c:270)\r\n==7605==    by 0x5903830: cb_fastcgi_on_connect (fcgi_handler.c:641)\r\n==7605==    by 0x11DD9D: mk_server_worker_loop (mk_server.c:455)\r\n==7605==    by 0x1158E6: mk_sched_launch_worker_loop (mk_scheduler.c:394)\r\n==7605==    by 0x513E0A3: start_thread (pthread_create.c:309)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==\r\n^C==7605== Invalid read of size 8\r\n==7605==    at 0x1596B8: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x1596B8: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x1596B8: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x1596B8: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x1596B8: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400000 is not stack'd, malloc'd or (recently) free'd\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x1596D4: je_arena_mapp_get (arena.h:511)\r\n==7605==    by 0x1596D4: je_arena_mapbitsp_get (arena.h:518)\r\n==7605==    by 0x1596D4: je_arena_mapbits_get (arena.h:532)\r\n==7605==    by 0x1596D4: je_arena_dalloc (arena.h:1036)\r\n==7605==    by 0x1596D4: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x1596D4: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x1596D4: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x1596D4: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x1596D4: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x13CBA6: je_arena_mapbits_small_runind_get (arena.h:564)\r\n==7605==    by 0x13CBA6: je_arena_dalloc_bin (arena.c:1914)\r\n==7605==    by 0x13CBA6: je_arena_dalloc_small (arena.c:1933)\r\n==7605==    by 0x159B85: je_arena_dalloc (arena.h:1046)\r\n==7605==    by 0x159B85: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x159B85: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x159B85: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x159B85: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x159B85: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x13C71A: je_arena_ptr_small_binind_get (arena.h:751)\r\n==7605==    by 0x13C71A: je_arena_dalloc_bin_locked (arena.c:1885)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_bin (arena.c:1917)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_small (arena.c:1933)\r\n==7605==    by 0x159B85: je_arena_dalloc (arena.h:1046)\r\n==7605==    by 0x159B85: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x159B85: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x159B85: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x159B85: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x159B85: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x13C71E: je_arena_mapbits_small_runind_get (arena.h:564)\r\n==7605==    by 0x13C71E: je_arena_dalloc_bin_locked (arena.c:1883)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_bin (arena.c:1917)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_small (arena.c:1933)\r\n==7605==    by 0x159B85: je_arena_dalloc (arena.h:1046)\r\n==7605==    by 0x159B85: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x159B85: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x159B85: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x159B85: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x159B85: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x13C792: je_arena_ptr_small_binind_get (arena.h:751)\r\n==7605==    by 0x13C792: arena_run_reg_dalloc (arena.c:307)\r\n==7605==    by 0x13C792: je_arena_dalloc_bin_locked (arena.c:1893)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_bin (arena.c:1917)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_small (arena.c:1933)\r\n==7605==    by 0x159B85: je_arena_dalloc (arena.h:1046)\r\n==7605==    by 0x159B85: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x159B85: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x159B85: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x159B85: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x159B85: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400190 is 336 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid write of size 8\r\n==7605==    at 0x135BA3: arena_run_tree_insert (arena.c:69)\r\n==7605==    by 0x13CA51: arena_bin_runs_insert (arena.c:1330)\r\n==7605==    by 0x13CA51: arena_bin_lower_run (arena.c:1868)\r\n==7605==    by 0x13CA51: je_arena_dalloc_bin_locked (arena.c:1898)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_bin (arena.c:1917)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_small (arena.c:1933)\r\n==7605==    by 0x159B85: je_arena_dalloc (arena.h:1046)\r\n==7605==    by 0x159B85: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x159B85: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x159B85: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x159B85: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x159B85: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400180 is 320 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid write of size 8\r\n==7605==    at 0x135BAA: arena_run_tree_insert (arena.c:69)\r\n==7605==    by 0x13CA51: arena_bin_runs_insert (arena.c:1330)\r\n==7605==    by 0x13CA51: arena_bin_lower_run (arena.c:1868)\r\n==7605==    by 0x13CA51: je_arena_dalloc_bin_locked (arena.c:1898)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_bin (arena.c:1917)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_small (arena.c:1933)\r\n==7605==    by 0x159B85: je_arena_dalloc (arena.h:1046)\r\n==7605==    by 0x159B85: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x159B85: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x159B85: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x159B85: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x159B85: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x6400188 is 328 bytes inside a block of size 568 free'd\r\n==7605==    at 0x4C29E90: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==7605==    by 0x55C07A4: fclose@@GLIBC_2.2.5 (iofclose.c:85)\r\n==7605==    by 0x127413: mk_rconf_create (mk_rconf.c:233)\r\n==7605==    by 0x113567: mk_config_read_files (mk_config.c:288)\r\n==7605==    by 0x113D3A: mk_config_start_configure (mk_config.c:473)\r\n==7605==    by 0x112665: mk_server_setup (monkey.c:93)\r\n==7605==    by 0x11215C: main (monkey.c:306)\r\n==7605==\r\n==7605== Invalid read of size 8\r\n==7605==    at 0x135BC0: arena_run_tree_insert (arena.c:69)\r\n==7605==    by 0x13CA51: arena_bin_runs_insert (arena.c:1330)\r\n==7605==    by 0x13CA51: arena_bin_lower_run (arena.c:1868)\r\n==7605==    by 0x13CA51: je_arena_dalloc_bin_locked (arena.c:1898)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_bin (arena.c:1917)\r\n==7605==    by 0x13CBD7: je_arena_dalloc_small (arena.c:1933)\r\n==7605==    by 0x159B85: je_arena_dalloc (arena.h:1046)\r\n==7605==    by 0x159B85: je_idalloct (jemalloc_internal.h:898)\r\n==7605==    by 0x159B85: je_idalloc (jemalloc_internal.h:907)\r\n==7605==    by 0x159B85: quarantine_drain_one (quarantine.c:84)\r\n==7605==    by 0x159B85: quarantine_drain (quarantine.c:96)\r\n==7605==    by 0x159B85: je_quarantine_cleanup (quarantine.c:182)\r\n==7605==    by 0x513DE61: __nptl_deallocate_tsd (pthread_create.c:157)\r\n==7605==    by 0x513E0B6: start_thread (pthread_create.c:322)\r\n==7605==    by 0x563D07C: clone (clone.S:111)\r\n==7605==  Address 0x8 is not stack'd, malloc'd or (recently) free'd\r\n==7605==\r\n[2015/08/13 09:40:48] [  Error] Segmentation fault (11), code=1, addr=0x8\r\n==7605==\r\n==7605== HEAP SUMMARY:\r\n==7605==     in use at exit: 147,780 bytes in 820 blocks\r\n==7605==   total heap usage: 2,029 allocs, 1,209 frees, 609,943 bytes allocated\r\n==7605==\r\n==7605== LEAK SUMMARY:\r\n==7605==    definitely lost: 64 bytes in 1 blocks\r\n==7605==    indirectly lost: 0 bytes in 0 blocks\r\n==7605==      possibly lost: 50,080 bytes in 197 blocks\r\n==7605==    still reachable: 97,636 bytes in 622 blocks\r\n==7605==         suppressed: 0 bytes in 0 blocks\r\n==7605== Rerun with --leak-check=full to see details of leaked memory\r\n==7605==\r\n==7605== For counts of detected and suppressed errors, rerun with: -v\r\n==7605== ERROR SUMMARY: 25 errors from 13 contexts (suppressed: 0 from 0)\r\n```\r\n\r\n\r\n#### Conclusions\r\n\r\n1. Instrumenting with afl has no effect on the crash.\r\n2. Tried building gcc 4.6, 4.9, 5.1 w/o any luck\r\n3. clang ASAN report doesn't seem to be a false-positive as gcc ASAN (with 4.9.3 and 5.1.1) all confirm the crash when curl'ing localhost:2001/test.php\r\n4. I also tried ./configure --malloc-libc, but build went with jemalloc?\r\n\r\n\r\n**note: each and every build was _clean_, deleting monkey-1.6.0 and extracting the src tar.gz before configure/make.**"}}