[*] launching /chromium/chromium/src/out/asan/chrome with --load-extension=/poc-artifacts/extension [*] profile dir: /tmp/dnr-poc-profile.riSGhf [*] indexing happens on a browser-process worker thread; wait several minutes for the multi-GiB JSON to be parsed before the OOB fires. [481:499:0520/013542.180097:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [481:499:0520/013542.180328:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [481:499:0520/013542.180444:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [481:499:0520/013542.180504:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [481:499:0520/013542.180546:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [481:499:0520/013542.199614:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [516:516:0520/013542.219915:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices [516:516:0520/013542.402689:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [481:481:0520/013542.445495:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [481:499:0520/013542.454057:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [518:518:0520/013557.338914:INFO:content/child/child_thread_impl.cc:903] Terminating current process after 15 seconds with no connection. [539:539:0520/013557.467022:INFO:content/child/child_thread_impl.cc:903] Terminating current process after 15 seconds with no connection. ================================================================= ==481==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7a7a8cdff280 at pc 0x572edeb12976 bp 0x7ffcf2838f00 sp 0x7ffcf28386b0 READ of size 1633771873 at 0x7a7a8cdff280 thread T0 (chrome) #0 0x572edeb12975 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) asan_interceptors.cpp #1 0x572edeb12d7c in memcmp (/chromium/chromium/src/out/asan/chrome+0x10d72d7c) (BuildId: 42c52701e3eebdcb) #2 0x572eed86adcd in extensions::declarative_net_request::(anonymous namespace)::BuildModifyHeaderInfoOffset(flatbuffers::FlatBufferBuilderImpl*, std::__Cr::vector> const&) third_party/flatbuffers/src/include/flatbuffers/flatbuffer_builder.h:647:12 #3 0x572eed86903a in extensions::declarative_net_request::FlatRulesetIndexer::AddUrlRule(extensions::declarative_net_request::IndexedRule const&) extensions/browser/api/declarative_net_request/flat_ruleset_indexer.cc:401:7 #4 0x572eed8eeb84 in extensions::declarative_net_request::RulesetSource::IndexRules(std::__Cr::vector>, unsigned char) const extensions/browser/api/declarative_net_request/ruleset_source.cc:111:15 #5 0x572eed85564b in extensions::declarative_net_request::(anonymous namespace)::IndexAndPersistRuleset(extensions::declarative_net_request::FileBackedRulesetSource const&, extensions::declarative_net_request::ReadJSONRulesResult, base::ElapsedTimer const&, unsigned char) extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc:172:14 #6 0x572eed8551d1 in extensions::declarative_net_request::FileBackedRulesetSource::IndexAndPersistJSONRulesetUnsafe(unsigned char) const extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc:373:10 #7 0x572eed88c983 in extensions::declarative_net_request::InstallIndexHelper::IndexStaticRulesetsUnsafe(extensions::Extension const&, extensions::declarative_net_request::FileBackedRulesetSource::RulesetFilter, unsigned char) extensions/browser/api/declarative_net_request/install_index_helper.cc:202:33 #8 0x572eed88c5b0 in extensions::declarative_net_request::InstallIndexHelper::IndexAndPersistRulesOnInstall(extensions::Extension&) extensions/browser/api/declarative_net_request/install_index_helper.cc:178:7 #9 0x572eedcb42e4 in extensions::UnpackedInstaller::IndexAndPersistRulesIfNeeded(std::__Cr::basic_string, std::__Cr::allocator>*) extensions/browser/unpacked_installer.cc:337:7 #10 0x572eedcb2210 in extensions::UnpackedInstaller::LoadExtension(extensions::mojom::ManifestLocation, int, std::__Cr::basic_string, std::__Cr::allocator>*) extensions/browser/unpacked_installer.cc:330:10 #11 0x572eedcb18a7 in extensions::UnpackedInstaller::LoadFromCommandLine(base::FilePath const&, std::__Cr::basic_string, std::__Cr::allocator>*, bool) extensions/browser/unpacked_installer.cc:171:8 #12 0x572ef1863e08 in extensions::ExtensionService::LoadExtensionsFromCommandLineFlag(char const*) chrome/browser/extensions/extension_service.cc:454:42 #13 0x572ef1862434 in extensions::ExtensionService::Init() chrome/browser/extensions/extension_service.cc:373:3 #14 0x572ef17e7523 in extensions::ChromeExtensionSystem::Shared::Init(bool) chrome/browser/extensions/chrome_extension_system.cc:308:23 #15 0x572ef17e8761 in extensions::ChromeExtensionSystem::InitForRegularProfile(bool) chrome/browser/extensions/chrome_extension_system.cc:401:12 #16 0x572ef2e2b14a in ProfileManager::DoFinalInitForServices(Profile*, bool) chrome/browser/profiles/profile_manager.cc:1591:46 #17 0x572ef2e2a382 in ProfileManager::DoFinalInit(ProfileManager::ProfileInfo*, bool) chrome/browser/profiles/profile_manager.cc:1530:3 #18 0x572ef2e1cfc4 in ProfileManager::CreateAndInitializeProfile(base::FilePath const&, base::OnceCallback> (base::FilePath const&)>) chrome/browser/profiles/profile_manager.cc:1871:3 #19 0x572ef2e19ef6 in ProfileManager::GetProfile(base::FilePath const&) chrome/browser/profiles/profile_manager.cc:807:10 #20 0x572ef353c422 in GetStartupProfile(base::FilePath const&, base::CommandLine const&) chrome/browser/ui/startup/startup_browser_creator.cc:1714:39 #21 0x572ef69df590 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:455:7 #22 0x572ef69de91c in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1449:18 #23 0x572eea621a4e in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28 #24 0x572eea628e91 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #25 0x572eec3664fd in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12 #26 0x572eea6208c5 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25 #27 0x572eea62c1e7 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:135:15 #28 0x572eea61b0ba in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32 #29 0x572ef355c8c1 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10 #30 0x572ef3560a08 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10 #31 0x572ef355fea0 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #32 0x572ef3559788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #33 0x572ef3559d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #34 0x572edebd0266 in ChromeMain chrome/app/chrome_main.cc:194:12 #35 0x7e7abba2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7a7a8cdff280 is located 0 bytes after 4950002304-byte region [0x7a7965d4e800,0x7a7a8cdff280) allocated by thread T0 (chrome) here: #0 0x572edebce6ad in operator new[](unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2e6ad) (BuildId: 42c52701e3eebdcb) #1 0x572eed86e429 in flatbuffers::vector_downward::reallocate(unsigned long) third_party/flatbuffers/src/include/flatbuffers/default_allocator.h:29:12 #2 0x572eed8802da in flatbuffers::FlatBufferBuilderImpl::CreateStringImpl(char const*, unsigned long) third_party/flatbuffers/src/include/flatbuffers/vector_downward.h:149:7 #3 0x572eed87fbee in flatbuffers::FlatBufferBuilderImpl::CreateSharedString(char const*, unsigned long) third_party/flatbuffers/src/include/flatbuffers/flatbuffer_builder.h:549:5 #4 0x572eed86adcd in extensions::declarative_net_request::(anonymous namespace)::BuildModifyHeaderInfoOffset(flatbuffers::FlatBufferBuilderImpl*, std::__Cr::vector> const&) third_party/flatbuffers/src/include/flatbuffers/flatbuffer_builder.h:647:12 #5 0x572eed86903a in extensions::declarative_net_request::FlatRulesetIndexer::AddUrlRule(extensions::declarative_net_request::IndexedRule const&) extensions/browser/api/declarative_net_request/flat_ruleset_indexer.cc:401:7 #6 0x572eed8eeb84 in extensions::declarative_net_request::RulesetSource::IndexRules(std::__Cr::vector>, unsigned char) const extensions/browser/api/declarative_net_request/ruleset_source.cc:111:15 #7 0x572eed85564b in extensions::declarative_net_request::(anonymous namespace)::IndexAndPersistRuleset(extensions::declarative_net_request::FileBackedRulesetSource const&, extensions::declarative_net_request::ReadJSONRulesResult, base::ElapsedTimer const&, unsigned char) extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc:172:14 #8 0x572eed8551d1 in extensions::declarative_net_request::FileBackedRulesetSource::IndexAndPersistJSONRulesetUnsafe(unsigned char) const extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc:373:10 #9 0x572eed88c983 in extensions::declarative_net_request::InstallIndexHelper::IndexStaticRulesetsUnsafe(extensions::Extension const&, extensions::declarative_net_request::FileBackedRulesetSource::RulesetFilter, unsigned char) extensions/browser/api/declarative_net_request/install_index_helper.cc:202:33 #10 0x572eed88c5b0 in extensions::declarative_net_request::InstallIndexHelper::IndexAndPersistRulesOnInstall(extensions::Extension&) extensions/browser/api/declarative_net_request/install_index_helper.cc:178:7 #11 0x572eedcb42e4 in extensions::UnpackedInstaller::IndexAndPersistRulesIfNeeded(std::__Cr::basic_string, std::__Cr::allocator>*) extensions/browser/unpacked_installer.cc:337:7 #12 0x572eedcb2210 in extensions::UnpackedInstaller::LoadExtension(extensions::mojom::ManifestLocation, int, std::__Cr::basic_string, std::__Cr::allocator>*) extensions/browser/unpacked_installer.cc:330:10 #13 0x572eedcb18a7 in extensions::UnpackedInstaller::LoadFromCommandLine(base::FilePath const&, std::__Cr::basic_string, std::__Cr::allocator>*, bool) extensions/browser/unpacked_installer.cc:171:8 #14 0x572ef1863e08 in extensions::ExtensionService::LoadExtensionsFromCommandLineFlag(char const*) chrome/browser/extensions/extension_service.cc:454:42 #15 0x572ef1862434 in extensions::ExtensionService::Init() chrome/browser/extensions/extension_service.cc:373:3 #16 0x572ef17e7523 in extensions::ChromeExtensionSystem::Shared::Init(bool) chrome/browser/extensions/chrome_extension_system.cc:308:23 #17 0x572ef17e8761 in extensions::ChromeExtensionSystem::InitForRegularProfile(bool) chrome/browser/extensions/chrome_extension_system.cc:401:12 #18 0x572ef2e2b14a in ProfileManager::DoFinalInitForServices(Profile*, bool) chrome/browser/profiles/profile_manager.cc:1591:46 #19 0x572ef2e2a382 in ProfileManager::DoFinalInit(ProfileManager::ProfileInfo*, bool) chrome/browser/profiles/profile_manager.cc:1530:3 #20 0x572ef2e1cfc4 in ProfileManager::CreateAndInitializeProfile(base::FilePath const&, base::OnceCallback> (base::FilePath const&)>) chrome/browser/profiles/profile_manager.cc:1871:3 #21 0x572ef2e19ef6 in ProfileManager::GetProfile(base::FilePath const&) chrome/browser/profiles/profile_manager.cc:807:10 #22 0x572ef353c422 in GetStartupProfile(base::FilePath const&, base::CommandLine const&) chrome/browser/ui/startup/startup_browser_creator.cc:1714:39 #23 0x572ef69df590 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:455:7 #24 0x572ef69de91c in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1449:18 #25 0x572eea621a4e in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28 #26 0x572eea628e91 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #27 0x572eec3664fd in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12 #28 0x572eea6208c5 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25 #29 0x572eea62c1e7 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:135:15 SUMMARY: AddressSanitizer: heap-buffer-overflow asan_interceptors.cpp in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) Shadow bytes around the buggy address: 0x7a7a8cdff000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7a7a8cdff080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7a7a8cdff100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7a7a8cdff180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7a7a8cdff200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x7a7a8cdff280:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7a7a8cdff300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7a7a8cdff380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7a7a8cdff400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7a7a8cdff480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7a7a8cdff500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==481==ADDITIONAL INFO ==481==Note: Please include this section with the ASan report. Task trace: Command line: `/chromium/chromium/src/out/asan/chrome --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --user-data-dir=/tmp/dnr-poc-profile.riSGhf --disable-extensions-except=/poc-artifacts/extension --load-extension=/poc-artifacts/extension --enable-logging=stderr --v=0 --ozone-platform=x11 --flag-switches-begin --flag-switches-end about:blank` ==481==END OF ADDITIONAL INFO ==481==ABORTING EXIT=1