C/C++: ==ERROR: AddressSanitizer: heap-use-after-free on address — memory used after delete/free

Meaning

Use-after-free is a leading cause of security bugs. The report has three stacks: the bad access, the freed by thread T0 here stack, and the previously allocated by stack. Typical cases are iterators or references into a std::vector that reallocated, a raw pointer outliving its owner, and callbacks capturing this of a deleted object.

Common causes

• Using a pointer after delete/free
• Holding a reference, pointer or iterator into a container that was resized or erased
• Callback or thread using an object that has been destroyed
• Returning .c_str()/.data() of a temporary string
• Two owners where one deletes

Detailed fix by platform

Code examples

#include <vector>

int main() {
    std::vector<int> v{1, 2, 3};
    int& first = v[0];
    v.push_back(4);          // may reallocate -> 'first' now points to freed memory
    return first;            // heap-use-after-free READ of size 4
    // fix: copy the value (int first = v[0];) or use indices
}

How to diagnose

1. Access — Where is the freed memory touched?
2. Free — Which line freed it?
3. Owner — Who is supposed to own this object?

More related errors