Note: Google Test filter = FPDFProgressiveRenderEmbedderTest.InsertObjectBetweenProgressiveStepsInvalidatesIterator [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from FPDFProgressiveRenderEmbedderTest [ RUN ] FPDFProgressiveRenderEmbedderTest.InsertObjectBetweenProgressiveStepsInvalidatesIterator ================================================================= ==1725==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b21859f3430 at pc 0x55ac02a8fad9 bp 0x7fff734c7d50 sp 0x7fff734c7d48 READ of size 8 at 0x7b21859f3430 thread T0 #0 0x55ac02a8fad8 in CPDF_ProgressiveRenderer::Continue(PauseIndicatorIface*) gen/third_party/libc++/src/include/deque:320:20 #1 0x55ac0261304a in FPDF_RenderPage_Continue third_party/pdfium/fpdfsdk/fpdf_progressive.cpp:150:23 #2 0x55ac00f4e10b in FPDFProgressiveRenderEmbedderTest_InsertObjectBetweenProgressiveStepsInvalidatesIterator_Test::TestBody() third_party/pdfium/core/fpdfapi/render/fpdf_progressive_render_embeddertest.cpp:181:12 #3 0x55ac083d3d5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x55ac083d5f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x55ac083d7ec3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x55ac08407b2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x55ac0840658e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x55ac00ed68c8 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #9 0x7f01869e2249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7b21859f3430 is located 0 bytes inside of 8-byte region [0x7b21859f3430,0x7b21859f3438) freed by thread T0 here: #0 0x55ac00ed6002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2bab002) (BuildId: 4bfdd59bf1a77772) #1 0x55ac02a3c7ef in std::__Cr::deque>, std::__Cr::allocator>>>::__add_back_capacity() gen/third_party/libc++/src/include/__new/allocate.h:63:10 #2 0x55ac02a38a6d in std::__Cr::deque>, std::__Cr::allocator>>>::push_back(std::__Cr::unique_ptr>&&) gen/third_party/libc++/src/include/deque:1615:5 #3 0x55ac02a38946 in CPDF_PageObjectHolder::AppendPageObject(std::__Cr::unique_ptr>) third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.cpp:189:21 #4 0x55ac025f2127 in FPDFPage_InsertObject third_party/pdfium/fpdfsdk/fpdf_editpage.cpp:302:10 #5 0x55ac00f4dd55 in FPDFProgressiveRenderEmbedderTest_InsertObjectBetweenProgressiveStepsInvalidatesIterator_Test::TestBody() third_party/pdfium/core/fpdfapi/render/fpdf_progressive_render_embeddertest.cpp:506:5 #6 0x55ac083d3d5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x55ac083d5f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #8 0x55ac083d7ec3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #9 0x55ac08407b2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #10 0x55ac0840658e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #11 0x55ac00ed68c8 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #12 0x7f01869e2249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x55ac00ed53fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2baa3fd) (BuildId: 4bfdd59bf1a77772) #1 0x55ac02a3c597 in std::__Cr::deque>, std::__Cr::allocator>>>::__add_back_capacity() gen/third_party/libc++/src/include/__new/allocate.h:43:28 #2 0x55ac02a38a6d in std::__Cr::deque>, std::__Cr::allocator>>>::push_back(std::__Cr::unique_ptr>&&) gen/third_party/libc++/src/include/deque:1615:5 #3 0x55ac02a38946 in CPDF_PageObjectHolder::AppendPageObject(std::__Cr::unique_ptr>) third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.cpp:189:21 #4 0x55ac02a65ffd in CPDF_StreamContentParser::AddPathObject(CFX_FillRenderOptions::FillType, CPDF_StreamContentParser::RenderType) third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.cpp:1630:21 #5 0x55ac02a6d961 in CPDF_StreamContentParser::Parse(pdfium::span, unsigned int, unsigned int, std::__Cr::vector> const&) third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.cpp:602:5 #6 0x55ac029e5af7 in CPDF_ContentParser::Parse() third_party/pdfium/core/fpdfapi/page/cpdf_contentparser.cpp:231:31 #7 0x55ac029e42f1 in CPDF_ContentParser::Continue(PauseIndicatorIface*) third_party/pdfium/core/fpdfapi/page/cpdf_contentparser.cpp:145:22 #8 0x55ac02a372fa in CPDF_PageObjectHolder::ContinueParse(PauseIndicatorIface*) third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.cpp:72:16 #9 0x55ac0839d211 in CPDFXFA_Page::LoadPDFPage() third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp:106:5 #10 0x55ac083905da in CPDFXFA_Context::GetOrCreateXFAPage(int) third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp:234:15 #11 0x55ac02628bf9 in FPDF_LoadPage third_party/pdfium/fpdfsdk/fpdf_view.cpp:457:42 #12 0x55ac017f9ce0 in EmbedderTest::LoadPageCommon(int, bool) third_party/pdfium/testing/embedder_test.cpp:829:20 #13 0x55ac017f9a84 in EmbedderTest::LoadScopedPage(int) third_party/pdfium/testing/embedder_test.cpp:817:10 #14 0x55ac00f4d3d3 in FPDFProgressiveRenderEmbedderTest_InsertObjectBetweenProgressiveStepsInvalidatesIterator_Test::TestBody() third_party/pdfium/core/fpdfapi/render/fpdf_progressive_render_embeddertest.cpp:472:21 #15 0x55ac083d3d5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #16 0x55ac083d5f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #17 0x55ac083d7ec3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #18 0x55ac08407b2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #19 0x55ac0840658e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #20 0x55ac00ed68c8 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #21 0x7f01869e2249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/deque:320:20 in CPDF_ProgressiveRenderer::Continue(PauseIndicatorIface*) Shadow bytes around the buggy address: 0x7b21859f3180: fa fa 00 fa fa fa 00 fa fa fa fc fc fa fa fd fa 0x7b21859f3200: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x7b21859f3280: fa fa fd fa fa fa fd fa fa fa 00 04 fa fa fd fa 0x7b21859f3300: fa fa 04 fa fa fa fd fd fa fa fd fd fa fa fd fd 0x7b21859f3380: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd =>0x7b21859f3400: fa fa fd fd fa fa[fd]fa fa fa fd fd fa fa fd fd 0x7b21859f3480: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x7b21859f3500: fa fa fd fd fa fa 00 04 fa fa fd fd fa fa 04 fa 0x7b21859f3580: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x7b21859f3600: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x7b21859f3680: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1725==ABORTING