-----------------------------------------------------
Exception at EIP=0000000003571127 (uef_cas_fill_wave(short*, int, unsigned char*)+0x0087): ACCESS VIOLATION
While attempting to read memory at 000000004c2ff67f
-----------------------------------------------------
RAX=0000000000004753 RBX=000000001820e3bc RCX=000000001820e3b8 RDX=000000003520fd8a
RSI=000000004828ec83 RDI=00000000170ef8f0 RBP=000000000c727f10 RSP=000000000c727e90
 R8=0000000000000000  R9=0000000000001650 R10=0000000000000000 R11=000000000a2bba64
R12=000000003520fd90 R13=7fff80007fff8000 R14=0000000000000001 R15=0000000000000b28
-----------------------------------------------------
Stack crawl:
  000000000c727ec0: 0000000003571127 (uef_cas_fill_wave(short*, int, unsigned char*)+0x0087)
  000000000c728050: 0000000003511675 (cassette_legacy_construct(cassette_image*, CassetteLegacyWaveFiller const*)+0x01a5)
  000000000c728080: 0000000003570cf4 (uef_cassette_load(cassette_image*)+0x0014)
  000000000c728110: 000000000350c8c2 (cassette_open_choices(void*, io_procs const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, CassetteFormat const* const*, int, cassette_image**)+0x0132)
  000000000c728190: 0000000002abba0b (non-virtual thunk to cassette_image_device::call_load()+0x007b)
  000000000c7281d0: 00000000033dd839 (device_image_interface::finish_load()+0x00a9)
  000000000c7282b0: 0000000003447db8 (image_manager::postdevice_init()+0x0198)
  000000000c7282f0: 000000000341204b (driver_device::device_start()+0x00db)
  000000000c728400: 00000000033d3bf0 (device_t::start()+0x0090)
  000000000c728470: 000000000346c1b9 (running_machine::start_all_devices()+0x00c9)
  000000000c728570: 0000000003471992 (running_machine::start()+0x0892)
  000000000c728610: 00000000034730fa (running_machine::run(bool)+0x005a)
  000000000c72f250: 0000000001d5861a (mame_machine_manager::execute()+0x020a)
  000000000c72f500: 0000000001dc6294 (cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&)+0x03f4)
  000000000c72f670: 0000000001dc6755 (cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x0045)
  000000000c72f6d0: 0000000001d565ca (emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x002a)
  000000000c72fe50: 0000000006b3b3ed (main+0x016d)
  000000000c72ff20: 00000000004013f7 (__tmainCRTStartup+0x0247)
  000000000c72ff50: 000000000040152b (mainCRTStartup+0x001b)
  000000000c72ff80: 00007ffbb2251fe4 (BaseThreadInitThunk+0x0014)
  000000000c72ffd0: 00007ffbb45aefb1 (RtlUserThreadStart+0x0021)

==94035==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62b000125b27 at pc 0x00000e98d8d7 bp 0x7ffd4111a110 sp 0x7ffd4111a108
READ of size 1 at 0x62b000125b27 thread T0
    #0 0xe98d8d6 in uef_cas_fill_wave(short*, int, unsigned char*) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/uef_cas.cpp:254:22
    #1 0xe8b41b0 in cassette_legacy_construct(cassette_image*, CassetteLegacyWaveFiller const*) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/cassimg.cpp:951:12
    #2 0xe98bbbd in uef_cassette_load(cassette_image*) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/uef_cas.cpp:337:9
    #3 0xe8af997 in cassette_open_choices(void*, io_procs const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, CassetteFormat const* const*, int, cassette_image**) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/cassimg.cpp:177:8
    #4 0xc6c0a55 in cassette_image_device::internal_load(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/cassette.cpp:287:10
    #5 0xc6c0de1 in call_load /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/cassette.cpp:258:9
    #6 0xc6c0de1 in non-virtual thunk to cassette_image_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/cassette.cpp
    #7 0xe108af6 in device_image_interface::finish_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/diimage.cpp:1163:11
    #8 0xe5686c8 in image_manager::postdevice_init() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/image.cpp:233:36
    #9 0xe1f0ca6 in driver_device::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/driver.cpp:207:20
    #10 0xe0e345d in device_t::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:489:2
    #11 0xe6a1f65 in running_machine::start_all_devices() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1040:13
    #12 0xe6a005d in running_machine::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:265:2
    #13 0xe6a2a41 in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:310:3
    #14 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #15 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #16 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #17 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #18 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #19 0x7fc4a26a182f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
    #20 0x1431838 in _start (/mnt/mame/mame64_as+0x1431838)

0x62b000125b27 is located 1 bytes to the right of 26918-byte region [0x62b00011f200,0x62b000125b26)
allocated by thread T0 here:
    #0 0x14d2a23 in malloc /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:67:3
    #1 0xe98dbf8 in uef_cas_to_wav_size(unsigned char const*, int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/uef_cas.cpp:127:23
    #2 0xe8b4079 in cassette_legacy_construct(cassette_image*, CassetteLegacyWaveFiller const*) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/cassimg.cpp:911:18
    #3 0xe98bbbd in uef_cassette_load(cassette_image*) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/uef_cas.cpp:337:9
    #4 0xe8af997 in cassette_open_choices(void*, io_procs const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, CassetteFormat const* const*, int, cassette_image**) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/cassimg.cpp:177:8
    #5 0xc6c0a55 in cassette_image_device::internal_load(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/cassette.cpp:287:10
    #6 0xc6c0de1 in call_load /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/cassette.cpp:258:9
    #7 0xc6c0de1 in non-virtual thunk to cassette_image_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/cassette.cpp
    #8 0xe108af6 in device_image_interface::finish_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/diimage.cpp:1163:11
    #9 0xe5686c8 in image_manager::postdevice_init() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/image.cpp:233:36
    #10 0xe1f0ca6 in driver_device::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/driver.cpp:207:20
    #11 0xe0e345d in device_t::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:489:2
    #12 0xe6a1f65 in running_machine::start_all_devices() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1040:13
    #13 0xe6a005d in running_machine::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:265:2
    #14 0xe6a2a41 in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:310:3
    #15 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #16 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #17 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #18 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #19 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #20 0x7fc4a26a182f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/uef_cas.cpp:254:22 in uef_cas_fill_wave(short*, int, unsigned char*)
Shadow bytes around the buggy address:
  0x0c568001cb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c568001cb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c568001cb30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c568001cb40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c568001cb50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c568001cb60: 00 00 00 00[06]fa fa fa fa fa fa fa fa fa fa fa
  0x0c568001cb70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c568001cb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c568001cb90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c568001cba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c568001cbb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb