[*] Cache primed: 10 entries, additionalSize=8000, lruCounter=20 [*] Counter advanced to wraparound boundary (mMaxStructuredBufferLruCount = 0xFFFFFFFF) [*] Triggering eviction with size=3200 at offset=0... [!] SELF-EVICTION: min_element picked the freshly-touched entry (offset=0, lruCount=0) ================================================================= ==803==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bbfe5fe0048 at pc 0x5648b2fdd948 bp 0x7ffeb0ecae60 sp 0x7ffeb0ecae58 WRITE of size 8 at 0x7bbfe5fe0048 thread T0 #0 0x5648b2fdd947 in StructuredBufferStorage::resizeStructuredBuffer(unsigned int) /poc-artifacts/algorithmic-proof.cpp:79:21 #1 0x5648b2fdcee1 in Buffer11::getStructuredBufferRangeSRV(unsigned int, unsigned int, unsigned int) /poc-artifacts/algorithmic-proof.cpp:204:38 #2 0x5648b2fdc5d5 in main /poc-artifacts/algorithmic-proof.cpp:305:9 #3 0x7f8fe6c0f249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) #4 0x7f8fe6c0f304 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27304) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) #5 0x5648b2ef6410 in _start (/tmp/proof+0x2e410) 0x7bbfe5fe0048 is located 8 bytes inside of 24-byte region [0x7bbfe5fe0040,0x7bbfe5fe0058) freed by thread T0 here: #0 0x5648b2fdbbf2 in operator delete(void*, unsigned long) (/tmp/proof+0x113bf2) #1 0x5648b2fe0c56 in StructuredBufferStorage::~StructuredBufferStorage() /poc-artifacts/algorithmic-proof.cpp:70:8 #2 0x5648b2fdd883 in void SafeDelete(BufferStorage*&) /poc-artifacts/algorithmic-proof.cpp:44:5 #3 0x5648b2fdce7e in Buffer11::getStructuredBufferRangeSRV(unsigned int, unsigned int, unsigned int) /poc-artifacts/algorithmic-proof.cpp:197:17 #4 0x5648b2fdc5d5 in main /poc-artifacts/algorithmic-proof.cpp:305:9 #5 0x7f8fe6c0f249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x5648b2fdafed in operator new(unsigned long) (/tmp/proof+0x112fed) #1 0x5648b2fdd629 in Buffer11::allocateStorage(unsigned long) /poc-artifacts/algorithmic-proof.cpp:134:16 #2 0x5648b2fdc9db in Buffer11::getStructuredBufferRangeSRV(unsigned int, unsigned int, unsigned int) /poc-artifacts/algorithmic-proof.cpp:155:40 #3 0x5648b2fdc4aa in main /poc-artifacts/algorithmic-proof.cpp:244:13 #4 0x7f8fe6c0f249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free /poc-artifacts/algorithmic-proof.cpp:79:21 in StructuredBufferStorage::resizeStructuredBuffer(unsigned int) Shadow bytes around the buggy address: 0x7bbfe5fdfd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7bbfe5fdfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7bbfe5fdfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7bbfe5fdff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7bbfe5fdff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x7bbfe5fe0000: fa fa 00 00 00 fa fa fa fd[fd]fd fa fa fa fd fd 0x7bbfe5fe0080: fd fa fa fa fd fd fd fa fa fa 00 00 00 fa fa fa 0x7bbfe5fe0100: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa 0x7bbfe5fe0180: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 0x7bbfe5fe0200: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7bbfe5fe0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==803==ABORTING