==3748==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x72dc13ab4a24 at pc 0x5e63b8b69575 bp 0x71ec0a20ee70 sp 0x71ec0a20e640 WRITE of size 8421504 at 0x72dc13ab4a24 thread T4 (ThreadPoolForeg) #0 0x5e63b8b69574 in __asan_memset (/chromium/chromium/src/out/asan/chrome+0x10df4574) (BuildId: 699db770cbe8c64e) #1 0x5e63d52f17d4 in av_xiphlacing third_party/ffmpeg/libavcodec/utils.c:834:14 0x72dc13ab4a24 is located 0 bytes after 164-byte region [0x72dc13ab4980,0x72dc13ab4a24) allocated by thread T4 (ThreadPoolForeg) here: #0 0x5e63b8b6bd3c in realloc (/chromium/chromium/src/out/asan/chrome+0x10df6d3c) (BuildId: 699db770cbe8c64e) #1 0x5e63d53cea67 in fixup_vorbis_headers third_party/ffmpeg/libavformat/oggparsevorbis.c:242:18 Thread T4 (ThreadPoolForeg) created by T0 (chrome) here: #0 0x5e63b8b4ed91 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dd9d91) (BuildId: 699db770cbe8c64e) #1 0x5e63d0e986e2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x5e63d0e0c264 in base::internal::WorkerThread::Start(scoped_refptr, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3 #3 0x5e63d0dce8b5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush() base/task/thread_pool/thread_group.cc:65:13 #4 0x5e63d0dce570 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor() base/task/thread_pool/thread_group.cc:56:3 #5 0x5e63d0dff374 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional) base/task/thread_pool/thread_group_impl.cc:71:3 #6 0x5e63d0ddbe75 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*) base/task/thread_pool/thread_pool_impl.cc:241:35 #7 0x5e63dd1139da in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr>, bool) content/child/child_process.cc:112:20 #8 0x5e63dd2a1940 in content::RenderProcess::RenderProcess(std::__Cr::unique_ptr>) content/renderer/render_process.cc:18:7 #9 0x5e63dd2a1178 in content::RenderProcessImpl::RenderProcessImpl() content/renderer/render_process_impl.cc:99:7 #10 0x5e63dd2a1720 in content::RenderProcessImpl::Create() content/renderer/render_process_impl.cc:224:31 #11 0x5e63dd340e15 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:274:53 #12 0x5e63cd531d29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #13 0x5e63cd532fdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #14 0x5e63cd535e55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #15 0x5e63cd52f788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #16 0x5e63cd52fd8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #17 0x5e63b8ba6266 in ChromeMain chrome/app/chrome_main.cc:194:12 #18 0x75ec1582b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-buffer-overflow (/chromium/chromium/src/out/asan/chrome+0x10df4574) (BuildId: 699db770cbe8c64e) in __asan_memset Shadow bytes around the buggy address: 0x72dc13ab4780: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x72dc13ab4800: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x72dc13ab4880: f7 fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72dc13ab4900: fd fd fd fd fd fd fd fd fa fa fa fa fa fa f7 fa 0x72dc13ab4980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x72dc13ab4a00: 00 00 00 00[04]fa fa fa fa fa fa fa f7 fa fa fa 0x72dc13ab4a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x72dc13ab4b00: fa fa fa fa fa fa fa fa fa fa f7 fa fd fd fd fd 0x72dc13ab4b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72dc13ab4c00: fd fd fa fa fa fa fa fa f7 fa fd fd fd fd fd fd 0x72dc13ab4c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3748==ADDITIONAL INFO ==3748==Note: Please include this section with the ASan report. Task trace: #0 0x5e63bc2db3e5 in media::FFmpegDemuxer::SeekInternal(base::TimeDelta, base::OnceCallback) media/filters/ffmpeg_demuxer.cc:1083:7 #1 0x5e63ba40a23f in media::PipelineImpl::Resume(base::TimeDelta, base::OnceCallback)>) media/base/pipeline_impl.cc:1499:7 #2 0x5e63df226c03 in blink::HTMLMediaElement::ScheduleNamedEvent(blink::AtomicString const&) third_party/blink/renderer/core/html/media/html_media_element.cc:936:36 #3 0x5e63ba3f87fa in media::PipelineImpl::RendererWrapper::ReportMetadata(media::Pipeline::StartType) media/base/pipeline_impl.cc:1309:7 Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=3675 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --autoplay-policy=no-user-gesture-required --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1778580823322105 --launch-time-ticks=643227565231 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,5319537802581416761,10483695709225314766,2097152 --field-trial-handle=3,i,15567195417107600795,1443743580225677869,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,5182453088928458532,12866290869091827520,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr` ==3748==END OF ADDITIONAL INFO ==3748==ABORTING