ClientDiscardableSharedMemoryManager::GetStatistics() const {
  base::AutoLock lock(lock_);
  Statistics stats;
  stats.total_size = heap_->GetSize();
  stats.freelist_size = heap_->GetSizeOfFreeLists();
  return stats;
}

The product writes data past the end, or before the beginning, of the intended buffer.