export CC="clang"
export CXX="clang++"
export CFLAGS="-fsanitize=address -g -O0 -fno-omit-frame-pointer"
export CXXFLAGS="-fsanitize=address -g -O0 -fno-omit-frame-pointer -stdlib=libc++"
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
export LD=$CC
export LDFLAGS="$CFLAGS"
rake -m
$CC -c $CFLAGS -Iinclude oss-fuzz/mruby_fuzzer.c -o mruby_fuzzer.o
$CXX $CXXFLAGS mruby_fuzzer.o $LIB_FUZZING_ENGINE -lm build/host/lib/libmruby.a -o mruby_fuzzer
./mruby_fuzzer $POC

root@fd74e910faaa:/src/mruby# ./mruby_fuzzer /root/mruby_crash.txt
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2550071349
./mruby_fuzzer: Running 1 inputs 1 time(s) each.
Running: /root/mruby_crash.txt
=================================================================
==8567==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x519000000480 at pc 0x623213b5be7b bp 0x7ffe0439b580 sp 0x7ffe0439b578
WRITE of size 8 at 0x519000000480 thread T0
    #0 0x623213b5be7a in stack_clear /src/mruby/src/vm.c:101:5
    #1 0x623213b87caf in mrb_vm_exec /src/mruby/src/vm.c:2957:7
    #2 0x623213b585d5 in mrb_vm_run /src/mruby/src/vm.c:1353:22
    #3 0x623213babeb5 in mrb_top_run /src/mruby/src/vm.c:3113:10
    #4 0x623213bf8fa2 in mrb_load_exec /src/mruby/mrbgems/mruby-compiler/core/parse.y:6928:7
    #5 0x623213bf9b34 in mrb_load_nstring_cxt /src/mruby/mrbgems/mruby-compiler/core/parse.y:7000:10
    #6 0x623213bf9bd0 in mrb_load_string_cxt /src/mruby/mrbgems/mruby-compiler/core/parse.y:7012:10
    #7 0x623213bf9c00 in mrb_load_string /src/mruby/mrbgems/mruby-compiler/core/parse.y:7018:10
    #8 0x623213ae4d02 in LLVMFuzzerTestOneInput /src/mruby/oss-fuzz/mruby_fuzzer.c:14:5
    #9 0x6232139997d0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #10 0x623213984a45 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #11 0x62321398a4df in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #12 0x6232139b5782 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #13 0x728846d0f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58)
    #14 0x62321397cc2d in _start (/src/mruby/mruby_fuzzer+0xd2c2d)
0x519000000480 is located 0 bytes after 1024-byte region [0x519000000080,0x519000000480)
allocated by thread T0 here:
    #0 0x623213aa598c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
    #1 0x623213c21d15 in mrb_default_allocf /src/mruby/src/allocf.c:27:12
    #2 0x623213b0a10e in mrb_realloc_simple /src/mruby/src/gc.c:197:8
    #3 0x623213b0a6f4 in mrb_realloc /src/mruby/src/gc.c:211:8
    #4 0x623213b0a820 in mrb_malloc /src/mruby/src/gc.c:227:10
    #5 0x623213b54dad in stack_init /src/mruby/src/vm.c:119:27
    #6 0x623213b580a5 in mrb_vm_run /src/mruby/src/vm.c:1339:5
    #7 0x623213babeb5 in mrb_top_run /src/mruby/src/vm.c:3113:10
    #8 0x623213c4d771 in mrb_load_proc /src/mruby/src/load.c:714:10
    #9 0x623213c17494 in mrb_init_mrblib /src/mruby/build/host/mrblib/mrblib.c:2007:3
    #10 0x623213bbfa77 in mrb_init_core /src/mruby/src/init.c:48:3
    #11 0x623213ae4fff in init_gc_and_core /src/mruby/src/state.c:35:3
    #12 0x623213aea97b in mrb_core_init_protect /src/mruby/src/error.c:562:5
    #13 0x623213ae4ea5 in mrb_open_core /src/mruby/src/state.c:53:7
    #14 0x623213ae50fc in mrb_open_allocf /src/mruby/src/state.c:80:20
    #15 0x623213ae50c7 in mrb_open /src/mruby/src/state.c:64:20
    #16 0x623213ae4cf1 in LLVMFuzzerTestOneInput /src/mruby/oss-fuzz/mruby_fuzzer.c:13:22
    #17 0x6232139997d0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #18 0x623213984a45 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #19 0x62321398a4df in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #20 0x6232139b5782 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #21 0x728846d0f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58)
SUMMARY: AddressSanitizer: heap-buffer-overflow /src/mruby/src/vm.c:101:5 in stack_clear
Shadow bytes around the buggy address:
  0x519000000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x519000000280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x519000000300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x519000000380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x519000000400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x519000000480:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x519000000500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x519000000580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x519000000600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x519000000680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x519000000700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8567==ABORTING