asan: Fix invalid memory access in UniversalExceptionRaise()

util/mach/exc_client_variants.cc

 // Copyright 2014 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 27 matching lines @@
   // exception_deliver() as far as the delivery logic is concerned. Unlike
   // exception_deliver(), this function does not get or set thread states for
   // behavior values that require this, as that is left to the caller to do if
   // needed.
 
   std::vector<exception_data_type_t> small_code_vector;
   exception_data_t small_code = nullptr;
   if ((behavior & MACH_EXCEPTION_CODES) == 0 && code_count) {
     small_code_vector.reserve(code_count);
     for (size_t code_index = 0; code_index < code_count; ++code_index) {
-      small_code_vector[code_index] = code[code_index];
+      small_code_vector.push_back(code[code_index]);
     }
     small_code = &small_code_vector[0];
   }
 
   // The *exception_raise*() family has bad declarations. Their code and
   // old_state arguments aren’t pointers to const data, although they should be.
   // The generated stubs in excUser.c and mach_excUser.c make it clear that the
   // data is never modified, and these parameters could be declared with const
   // appropriately. The uses of const_cast below are thus safe.
 
@@ skipping 61 matching lines @@
           new_state,
           new_state_count);
 
     default:
       NOTREACHED();
       return KERN_INVALID_ARGUMENT;
   }
 }
 
 }  // namespace crashpad