heap-use-after-free in saveobj

[elunna]

Popped up Nov 12, 2023. Could be related to disappearing boh? No rr recording unfortunately.

=================================================================
==122120==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040021d2190 at pc 0x555556142f74 bp 0x7fffffffda00 sp 0x7fffffffd9f0
READ of size 8 at 0x6040021d2190 thread T0
    #0 0x555556142f73 in saveobj /home/user/Documents/hackem/src/save.c:1090
    #1 0x5555561437b7 in saveobjchn /home/user/Documents/hackem/src/save.c:1134
    #2 0x555556140b7a in savegamestate /home/user/Documents/hackem/src/save.c:347
    #3 0x555556141629 in savestateinlock /home/user/Documents/hackem/src/save.c:481
    #4 0x55555595505b in save_currentstate /home/user/Documents/hackem/src/do.c:1635
    #5 0x55555595b184 in goto_level /home/user/Documents/hackem/src/do.c:2240
    #6 0x55555595b743 in deferred_goto /home/user/Documents/hackem/src/do.c:2326
    #7 0x5555557974fc in moveloop /home/user/Documents/hackem/src/allmain.c:815
    #8 0x5555564c2dcd in main ../sys/unix/unixmain.c:353
    #9 0x7ffff7364d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #10 0x7ffff7364e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #11 0x55555578eac4 in _start (/home/user/games/hackemdir/hackem+0x23aac4)

0x6040021d2190 is located 0 bytes inside of 40-byte region [0x6040021d2190,0x6040021d21b8)
freed by thread T0 here:
    #0 0x7ffff7671537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x555555dc2ecc in dealloc_oextra /home/user/Documents/hackem/src/mkobj.c:103
    #2 0x555555dd58b4 in dealloc_obj /home/user/Documents/hackem/src/mkobj.c:2654
    #3 0x555556143bcf in saveobjchn /home/user/Documents/hackem/src/save.c:1171
    #4 0x555556141c6a in savelev /home/user/Documents/hackem/src/save.c:613
    #5 0x555555956811 in goto_level /home/user/Documents/hackem/src/do.c:1864
    #6 0x55555595b743 in deferred_goto /home/user/Documents/hackem/src/do.c:2326
    #7 0x5555557974fc in moveloop /home/user/Documents/hackem/src/allmain.c:815
    #8 0x5555564c2dcd in main ../sys/unix/unixmain.c:353
    #9 0x7ffff7364d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    #0 0x7ffff7671887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55555579b59c in alloc /home/user/Documents/hackem/src/alloc.c:46
    #2 0x555555dc2c3a in newoextra /home/user/Documents/hackem/src/mkobj.c:76
    #3 0x55555596e608 in new_oname /home/user/Documents/hackem/src/do_name.c:1033
    #4 0x5555559774e0 in oname /home/user/Documents/hackem/src/do_name.c:1335
    #5 0x555555977124 in do_oname /home/user/Documents/hackem/src/do_name.c:1308
    #6 0x55555597960c in docallcmd /home/user/Documents/hackem/src/do_name.c:1497
    #7 0x5555558a73f9 in rhack /home/user/Documents/hackem/src/cmd.c:5812
    #8 0x5555557974ba in moveloop /home/user/Documents/hackem/src/allmain.c:812
    #9 0x5555564c2dcd in main ../sys/unix/unixmain.c:353
    #10 0x7ffff7364d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /home/user/Documents/hackem/src/save.c:1090 in saveobj
Shadow bytes around the buggy address:
  0x0c08804323e0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c08804323f0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c0880432400: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c0880432410: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c0880432420: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
=>0x0c0880432430: fa fa[fd]fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c0880432440: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c0880432450: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c0880432460: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c0880432470: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c0880432480: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==122120==ABORTING