IMPORTANT DEBUGGING NOTE: batches of tests are run inside their own process. For debugging a test inside a debugger, use the --gtest_filter= flag along with --single-process-tests. Using sharding settings from environment. This is shard 0/1 Using 1 parallel jobs. Note: Google Test filter = CastDoubleStartPlayingFromUAF.VendorPendingBufferFreed [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from CastDoubleStartPlayingFromUAF [ RUN ] CastDoubleStartPlayingFromUAF.VendorPendingBufferFreed [49626:49626:INFO:chromecast/media/cma/pipeline/media_pipeline_impl.cc:95] MediaPipelineImpl [49626:49626:INFO:chromecast/media/cma/pipeline/media_pipeline_impl.cc:117] Initialize [49626:49626:INFO:chromecast/media/cma/pipeline/video_pipeline_impl.cc:46] Initialize codec: h264, profile: h264 main, level: not available, alpha_mode: is_opaque, coded size: [640,480], visible rect: [0,0,640,480], natural size: [640,480], has extra data: false, encryption scheme: Unencrypted, rotation: 0°, flipped: 0, color space: {primaries:INVALID, transfer:INVALID, matrix:INVALID, range:INVALID} [49626:49626:INFO:chromecast/media/cma/pipeline/media_pipeline_impl.cc:209] StartPlayingFrom t0=0 [49626:49626:INFO:chromecast/media/cma/pipeline/av_pipeline_impl.cc:69] StartPlayingFrom t0=0 [49626:49626:INFO:chromecast/media/cma/pipeline/video_pipeline_impl.cc:107] OnUpdateConfig id:0 codec: h264, profile: unknown, level: not available, alpha_mode: is_opaque, coded size: [640,480], visible rect: [0,0,640,480], natural size: [640,480], has extra data: false, encryption scheme: Unencrypted, rotation: 0°, flipped: 0, color space: {primaries:INVALID, transfer:INVALID, matrix:INVALID, range:INVALID} [49626:49626:INFO:chromecast/media/base/media_codec_support.cc:152] Unsupported video codec profile -1 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #1 raw=0x7b57035eb010 eos=0 [49626:49626:INFO:chromecast/media/cma/pipeline/media_pipeline_impl.cc:209] StartPlayingFrom t0=10 [49626:49626:INFO:chromecast/media/cma/pipeline/av_pipeline_impl.cc:69] StartPlayingFrom t0=10 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #2 raw=0x7b57035eb210 eos=0 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #3 raw=0x7b57035eb290 eos=0 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #4 raw=0x7b57035eb310 eos=0 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #5 raw=0x7b57035eb390 eos=0 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #6 raw=0x7b57035eb410 eos=0 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #7 raw=0x7b57035eb490 eos=0 [49626:49626:INFO:chromecast/media/cma/pipeline/av_pipeline_impl.cc:202] ProcessPendingBuffer: EOS reached, stopped feeding [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:69] [vendor] PushBuffer #8 raw=0x7b57035eb510 eos=1 [49626:49626:INFO:chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:95] [vendor] async drain: dereferencing stored CastDecoderBuffer* 0x7b57035eb010 ================================================================= ==49626==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b57035eb010 at pc 0x562c95e4a4fa bp 0x7ffee23fec70 sp 0x7ffee23fec68 READ of size 8 at 0x7b57035eb010 thread T0 #0 0x562c95e4a4f9 in chromecast::media::CastDoubleStartPlayingFromUAF_VendorPendingBufferFreed_Test::TestBody() chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:101:48 #1 0x562c97a9b25b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2746:5 #2 0x562c97a9be38 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #3 0x562c97a9d199 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #4 0x562c97ab002e in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #5 0x562c97aaf5ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #6 0x562c984b20ca in base::TestSuite::Run() base/test/test_suite.cc:440:16 #7 0x562c98487cb3 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #8 0x562c96637a18 in base::OnceCallback::Run() && base/functional/callback.h:155:12 #9 0x562c984bbe99 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/test/launcher/unit_test_launcher.cc:189:38 #10 0x562c984bb89e in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x562c984879bf in main base/test/run_all_unittests.cc:79:10 #12 0x7f1704b05249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7b57035eb010 is located 0 bytes inside of 48-byte region [0x7b57035eb010,0x7b57035eb040) freed by thread T0 here: #0 0x562c95e48942 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan-cast/cast_double_start_uaf_poc+0x3603942) (BuildId: 0198c345ba10342b) #1 0x562c95e74951 in scoped_refptr::operator=(scoped_refptr) base/memory/scoped_refptr.h:307:3 #2 0x562c95e96b70 in chromecast::media::VideoDecoderWrapper::PushBuffer(scoped_refptr) chromecast/media/common/video_decoder_wrapper.cc:76:18 #3 0x562c95e75db3 in chromecast::media::AvPipelineImpl::PushReadyBuffer(scoped_refptr) chromecast/media/cma/pipeline/av_pipeline_impl.cc:272:47 #4 0x562c95e754a7 in chromecast::media::AvPipelineImpl::ProcessPendingBuffer() chromecast/media/cma/pipeline/av_pipeline_impl.cc:245:3 #5 0x562c95e747da in chromecast::media::AvPipelineImpl::OnNewFrame(scoped_refptr const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&) chromecast/media/cma/pipeline/av_pipeline_impl.cc:191:3 #6 0x562c95e79174 in void base::internal::Invoker const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&), base::WeakPtr&&>, base::internal::BindState const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&), base::WeakPtr>, void (scoped_refptr const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>::RunImpl const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&), std::__Cr::tuple>, 0ul>(void (chromecast::media::AvPipelineImpl::*&&)(scoped_refptr const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&), std::__Cr::tuple>&&, std::__Cr::integer_sequence, scoped_refptr const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&) base/functional/bind_internal.h:1069:14 #7 0x562c95e584b1 in base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>::Run(scoped_refptr const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&) && base/functional/callback.h:155:12 #8 0x562c95e6233e in chromecast::media::BufferingFrameProvider::CompleteReadIfNeeded() chromecast/media/cma/base/buffering_frame_provider.cc:136:23 #9 0x562c95e62064 in chromecast::media::BufferingFrameProvider::Read(base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>) chromecast/media/cma/base/buffering_frame_provider.cc:61:3 #10 0x562c95e743ff in chromecast::media::AvPipelineImpl::FetchBuffer() chromecast/media/cma/pipeline/av_pipeline_impl.cc:173:20 #11 0x562c95e7876a in void base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunImpl>, 0ul>(void (chromecast::media::AvPipelineImpl::*&&)(), std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:1069:14 #12 0x562c98282cc6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #13 0x562c982f7979 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #14 0x562c982f67ea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #15 0x562c982b5577 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #16 0x562c982f9087 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #17 0x562c98252fb0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #18 0x562c98254f7c in base::RunLoop::RunUntilIdle() base/run_loop.cc:144:3 #19 0x562c9848baec in base::test::TaskEnvironment::RunUntilIdle() base/test/task_environment.cc:712:51 #20 0x562c95e49d39 in chromecast::media::CastDoubleStartPlayingFromUAF_VendorPendingBufferFreed_Test::TestBody() chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:217:20 #21 0x562c97a9b25b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2746:5 #22 0x562c97a9be38 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #23 0x562c97a9d199 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #24 0x562c97ab002e in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #25 0x562c97aaf5ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #26 0x562c984b20ca in base::TestSuite::Run() base/test/test_suite.cc:440:16 #27 0x562c98487cb3 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #28 0x562c96637a18 in base::OnceCallback::Run() && base/functional/callback.h:155:12 #29 0x562c984bbe99 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/test/launcher/unit_test_launcher.cc:189:38 previously allocated by thread T0 here: #0 0x562c95e47d3d in operator new(unsigned long) (/chromium/chromium/src/out/asan-cast/cast_double_start_uaf_poc+0x3602d3d) (BuildId: 0198c345ba10342b) #1 0x562c95e5278d in chromecast::media::FrameGeneratorForTest::Generate() chromecast/media/cma/test/frame_generator_for_test.cc:108:43 #2 0x562c95e57b41 in chromecast::media::MockFrameProvider::DoRead(base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>) chromecast/media/cma/test/mock_frame_provider.cc:73:61 #3 0x562c95e58b0b in void base::internal::DecayedFunctorTraits const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), chromecast::media::MockFrameProvider*, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>&&>::Invoke const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), chromecast::media::MockFrameProvider*, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>>(void (chromecast::media::MockFrameProvider::*)(base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), chromecast::media::MockFrameProvider*&&, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>&&) base/functional/bind_internal.h:740:12 #4 0x562c95e58939 in void base::internal::InvokeHelper const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), chromecast::media::MockFrameProvider*, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>&&>, void, 0ul, 1ul>::MakeItSo const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), std::__Cr::tuple, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>>>(void (chromecast::media::MockFrameProvider::*&&)(base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), std::__Cr::tuple, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>>&&) base/functional/bind_internal.h:932:12 #5 0x562c95e5881d in void base::internal::Invoker const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), chromecast::media::MockFrameProvider*, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>&&>, base::internal::BindState const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), base::internal::UnretainedWrapper, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>>, void ()>::RunImpl const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), std::__Cr::tuple, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>>, 0ul, 1ul>(void (chromecast::media::MockFrameProvider::*&&)(base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>), std::__Cr::tuple, base::OnceCallback const&, media::AudioDecoderConfig const&, media::VideoDecoderConfig const&)>>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:1069:14 #6 0x562c98282cc6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #7 0x562c982f7979 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #8 0x562c982f67ea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #9 0x562c982b5577 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #10 0x562c982f9087 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #11 0x562c98252fb0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #12 0x562c98254f7c in base::RunLoop::RunUntilIdle() base/run_loop.cc:144:3 #13 0x562c9848baec in base::test::TaskEnvironment::RunUntilIdle() base/test/task_environment.cc:712:51 #14 0x562c95e49cb9 in chromecast::media::CastDoubleStartPlayingFromUAF_VendorPendingBufferFreed_Test::TestBody() chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:207:20 #15 0x562c97a9b25b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2746:5 #16 0x562c97a9be38 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #17 0x562c97a9d199 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #18 0x562c97ab002e in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #19 0x562c97aaf5ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #20 0x562c984b20ca in base::TestSuite::Run() base/test/test_suite.cc:440:16 #21 0x562c98487cb3 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x562c96637a18 in base::OnceCallback::Run() && base/functional/callback.h:155:12 #23 0x562c984bbe99 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/test/launcher/unit_test_launcher.cc:189:38 #24 0x562c984bb89e in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #25 0x562c984879bf in main base/test/run_all_unittests.cc:79:10 #26 0x7f1704b05249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:101:48 in chromecast::media::CastDoubleStartPlayingFromUAF_VendorPendingBufferFreed_Test::TestBody() Shadow bytes around the buggy address: 0x7b57035ead80: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa 0x7b57035eae00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x7b57035eae80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x7b57035eaf00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 0x7b57035eaf80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd =>0x7b57035eb000: fa fa[fd]fd fd fd fd fd fa fa fd fd fd fd fd fd 0x7b57035eb080: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x7b57035eb100: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x7b57035eb180: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd 0x7b57035eb200: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x7b57035eb280: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==49626==ADDITIONAL INFO ==49626==Note: Please include this section with the ASan report. Task trace: ==49626==END OF ADDITIONAL INFO ==49626==ABORTING [1/1] CastDoubleStartPlayingFromUAF.VendorPendingBufferFreed (CRASHED) 1 test crashed: CastDoubleStartPlayingFromUAF.VendorPendingBufferFreed (../../chromecast/media/cma/pipeline/double_start_uaf_unittest.cc:182) Tests took 1 seconds.