MultiChannelResampler resamples multi-channel audio. As an optimization it avoided allocating memory for the first channel by borrowing the caller-provided output buffer as the channel-0 backing store of its internal m_multiChannelBus: the constructor created the AudioBus without memory and only allocated AudioFloatArrays for channels 1..N-1 (m_channelsMemory), and process()/provideInputForChannel() called m_multiChannelBus->setChannelMemory(0, buffer.data(), framesToProcess) to point channel 0 at the caller’s transient buffer. That makes the AudioBus alias external memory whose lifetime and size are not owned by the resampler; when the resampler is driven from an AudioWorklet (author JS on the real-time audio thread) the borrowed buffer can be reused/freed or have a different length across the concurrent processing, so the AudioBus references stale or wrong-sized memory — a use-after-free / out-of-bounds on the audio channel data (the regression test is audioworklet-concurrent-resampler-crash).

The fix removes the borrowing optimization: the AudioBus is created with its own owned memory (AudioBus::create(numberOfChannels, requestFrames)), the separate m_channelsMemory vector is deleted, and process() no longer aliases the caller’s buffer for channel 0 (the ASSERT is relaxed from == to <= length).

The restored invariant is that the resampler’s AudioBus owns all its channel memory, so no channel points at externally-owned, potentially-stale buffers.

A use-after-free / out-of-bounds on audio channel memory caused by aliasing a caller-owned buffer in the resampler’s AudioBus, reachable from WebAudio/AudioWorklet in the WebContent process. Concurrent worklet processing gives attacker-influenced timing over the stale buffer; the observable is a crash, with corruption potential. Confined to WebContent; rated medium.