IMPORTANT DEBUGGING NOTE: batches of tests are run inside their own process. For debugging a test inside a debugger, use the --gtest_filter= flag along with --single-process-tests. Using sharding settings from environment. This is shard 0/1 Using 1 parallel jobs. Note: Google Test filter = DrmUtilSignednessPoc.SubsampleSignednessFlip [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from DrmUtilSignednessPoc [ RUN ] DrmUtilSignednessPoc.SubsampleSignednessFlip [POC] clear_bytes=0x80000000 -> clear_byte_count=-2147483648, cypher_bytes=0xfffffff0 -> encrypted_byte_count=-16 [POC] simulating vendor SbPlayerWriteSample2 CENC walk: buffer=0x7b2ca0be19d0 size=16 clear_byte_count=-8 encrypted_byte_count=8 ================================================================= ==20292==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b2ca0be19c8 at pc 0x56171ab9183d bp 0x7ffc472da870 sp 0x7ffc472da868 READ of size 1 at 0x7b2ca0be19c8 thread T0 #0 0x56171ab9183c in chromecast::media::(anonymous namespace)::SimulateVendorCencSubsampleWalk(unsigned char*, chromecast::media::StarboardDrmSampleInfo const*) chromecast/starboard/media/media/drm_util_signedness_poc.cc:59:10 #1 0x56171ab9052d in chromecast::media::(anonymous namespace)::DrmUtilSignednessPoc_SubsampleSignednessFlip_Test::TestBody() chromecast/starboard/media/media/drm_util_signedness_poc.cc:138:3 #2 0x56171dea78bb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x56171dea9ab7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x56171deabbc3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x56171dedba1a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x56171deda47e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x561721792b0c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x56171e2f8161 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x5617217ae8bb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x5617217ae1db in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x56171e2f7e50 in main base/test/run_all_unittests.cc:79:10 #12 0x7f0ca2492249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7b2ca0be19c8 is located 8 bytes before 16-byte region [0x7b2ca0be19d0,0x7b2ca0be19e0) allocated by thread T0 here: #0 0x56171ab8cf0d in operator new[](unsigned long) (/chromium/chromium/src/out/asan/drm_util_signedness_poc+0x2df8f0d) (BuildId: 34986e463aa642f3) #1 0x56171ab8ef5b in chromecast::media::(anonymous namespace)::DrmUtilSignednessPoc_SubsampleSignednessFlip_Test::TestBody() chromecast/starboard/media/media/drm_util_signedness_poc.cc:85:39 #2 0x56171dea78bb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x56171dea9ab7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x56171deabbc3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x56171dedba1a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x56171deda47e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x561721792b0c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x56171e2f8161 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x5617217ae8bb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x5617217ae1db in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x56171e2f7e50 in main base/test/run_all_unittests.cc:79:10 #12 0x7f0ca2492249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-buffer-overflow chromecast/starboard/media/media/drm_util_signedness_poc.cc:59:10 in chromecast::media::(anonymous namespace)::SimulateVendorCencSubsampleWalk(unsigned char*, chromecast::media::StarboardDrmSampleInfo const*) Shadow bytes around the buggy address: 0x7b2ca0be1700: fa fa 00 fa fa fa 00 06 fa fa 00 06 fa fa 05 fa 0x7b2ca0be1780: fa fa 00 06 fa fa 05 fa fa fa 00 06 fa fa 00 02 0x7b2ca0be1800: fa fa 06 fa fa fa fd fa fa fa fd fa fa fa fd fa 0x7b2ca0be1880: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x7b2ca0be1900: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa =>0x7b2ca0be1980: fa fa fd fa fa fa 00 00 fa[fa]00 00 fa fa fd fd 0x7b2ca0be1a00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 00 0x7b2ca0be1a80: fa fa fd fa fa fa 00 fa fa fa 00 fa fa fa fa fa 0x7b2ca0be1b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b2ca0be1b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b2ca0be1c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==20292==ADDITIONAL INFO ==20292==Note: Please include this section with the ASan report. Task trace: ==20292==END OF ADDITIONAL INFO ==20292==ABORTING [1/1] DrmUtilSignednessPoc.SubsampleSignednessFlip (CRASHED) 1 test crashed: DrmUtilSignednessPoc.SubsampleSignednessFlip (../../chromecast/starboard/media/media/drm_util_signedness_poc.cc:77) Tests took 0 seconds.