[==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from SyncGroupUafPoc [ RUN ] SyncGroupUafPoc.OnUpdateSyncGroupLeavesStaleSyncableAudio ================================================================= ==2966==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c2035fe5150 at pc 0x5607f3fd92ff bp 0x7ffc4a13f890 sp 0x7ffc4a13f888 READ of size 8 at 0x7c2035fe5150 thread T0 #0 0x5607f3fd92fe in webrtc::internal::RtpStreamsSynchronizer::UpdateDelay() third_party/webrtc/video/rtp_streams_synchronizer2.cc:107:63 #1 0x5607f3fda751 in webrtc::TimeDelta absl::internal_any_invocable::LocalInvoker(absl::internal_any_invocable::TypeErasedState*) third_party/webrtc/video/rtp_streams_synchronizer2.cc:85:9 #2 0x5607f3c528d0 in void absl::internal_any_invocable::RemoteInvoker(absl::internal_any_invocable::TypeErasedState*) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:766:1 #3 0x5607f3c3814b in webrtc::Thread::Dispatch(absl::AnyInvocable) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #4 0x5607f3c34ed6 in webrtc::Thread::ProcessMessages(int) third_party/webrtc/rtc_base/thread.cc:883:5 #5 0x5607f2c80d90 in webrtc::test::RunLoop::RunFor(webrtc::TimeDelta) third_party/webrtc/test/run_loop.cc:45:18 #6 0x5607f2b7968b in webrtc::(anonymous namespace)::SyncGroupUafPoc_OnUpdateSyncGroupLeavesStaleSyncableAudio_Test::TestBody() third_party/webrtc/call/sync_group_uaf_poctest.cc:122:8 #7 0x5607f3391b7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x5607f3393d77 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #9 0x5607f3395ce3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #10 0x5607f33c57ca in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #11 0x5607f33c422e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #12 0x5607f2b778bb in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #13 0x7f0037038249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7c2035fe5150 is located 16 bytes inside of 264-byte region [0x7c2035fe5140,0x7c2035fe5248) freed by thread T0 here: #0 0x5607f2b76d02 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/sync_group_uaf_poctest+0x99ed02) (BuildId: 6a7fcc1618f5bb16) #1 0x5607f38196b1 in webrtc::internal::Call::DestroyAudioReceiveStream(webrtc::AudioReceiveStreamInterface*) third_party/webrtc/call/call.cc:886:3 #2 0x5607f2b7967d in webrtc::(anonymous namespace)::SyncGroupUafPoc_OnUpdateSyncGroupLeavesStaleSyncableAudio_Test::TestBody() third_party/webrtc/call/sync_group_uaf_poctest.cc:115:9 #3 0x5607f3391b7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x5607f3393d77 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x5607f3395ce3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x5607f33c57ca in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x5607f33c422e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x5607f2b778bb in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #9 0x7f0037038249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x5607f2b760fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/sync_group_uaf_poctest+0x99e0fd) (BuildId: 6a7fcc1618f5bb16) #1 0x5607f3818df3 in webrtc::internal::Call::CreateAudioReceiveStream(webrtc::AudioReceiveStreamInterface::Config const&) third_party/webrtc/call/call.cc:843:44 #2 0x5607f2b79312 in webrtc::(anonymous namespace)::SyncGroupUafPoc_OnUpdateSyncGroupLeavesStaleSyncableAudio_Test::TestBody() third_party/webrtc/call/sync_group_uaf_poctest.cc:101:13 #3 0x5607f3391b7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x5607f3393d77 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x5607f3395ce3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x5607f33c57ca in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x5607f33c422e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x5607f2b778bb in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #9 0x7f0037038249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free third_party/webrtc/video/rtp_streams_synchronizer2.cc:107:63 in webrtc::internal::RtpStreamsSynchronizer::UpdateDelay() Shadow bytes around the buggy address: 0x7c2035fe4e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c2035fe4f00: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x7c2035fe4f80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x7c2035fe5000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2035fe5080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7c2035fe5100: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd 0x7c2035fe5180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2035fe5200: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x7c2035fe5280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2035fe5300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2035fe5380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2966==ABORTING