Technically, the first one is a heap use-after-free, while the second a stack buffer overflow. They could be two different manifestations of the same issue; they both originate from handle_ti() and the root cause may be the same.
Heap uaf:
=================================================================
==129653==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290000b5000 at pc 0x7f0c3d947dd3 bp 0x7f0c13bfdac0 sp 0x7f0c13bfd270
READ of size 27 at 0x6290000b5000 thread T7
#0 0x7f0c3d947dd2 in __interceptor_memcpy (/lib64/libasan.so.6+0x39dd2)
#1 0x562c1c7292b2 in flatview_write_continue softmmu/physmem.c:2781
#2 0x562c1c729589 in flatview_write softmmu/physmem.c:2816
#3 0x562c1c729ef7 in address_space_write softmmu/physmem.c:2908
#4 0x562c1c729faf in address_space_rw softmmu/physmem.c:2918
#5 0x562c1c217754 in dma_memory_rw_relaxed include/sysemu/dma.h:8
#6 0x562c1c2177a1 in dma_memory_rw include/sysemu/dma.h:127
#7 0x562c1c21791b in pci_dma_rw include/hw/pci/pci.h:803
#8 0x562c1c21b6e3 in esp_pci_dma_memory_rw hw/scsi/esp-pci.c:283
#9 0x562c1c21ba6e in esp_pci_dma_memory_write hw/scsi/esp-pci.c:302
#10 0x562c1c428685 in esp_do_dma hw/scsi/esp.c:526
#11 0x562c1c429cb5 in handle_ti hw/scsi/esp.c:629
...
Stack bof:
=================================================================
==138588==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc8a90c300 at pc 0x559b1de0780e bp 0x7ffc8a90bd10 sp 0x7ffc8a90bd08
WRITE of size 4 at 0x7ffc8a90c300 thread T0
#0 0x559b1de0780d in stl_he_p include/qemu/bswap.h:353
#1 0x559b1de07dec in stn_he_p include/qemu/bswap.h:486
#2 0x559b1de23e47 in flatview_read_continue softmmu/physmem.c:2841
#3 0x559b1de24215 in flatview_read softmmu/physmem.c:2879
#4 0x559b1de243b5 in address_space_read_full softmmu/physmem.c:2892
#5 0x559b1de2462c in address_space_rw softmmu/physmem.c:2920
#6 0x559b1d1ec514 in dma_memory_rw_relaxed include/sysemu/dma.h:88
#7 0x559b1d1ec561 in dma_memory_rw include/sysemu/dma.h:127
#8 0x559b1d1ec6db in pci_dma_rw include/hw/pci/pci.h:803
#9 0x559b1d1f04a3 in esp_pci_dma_memory_rw hw/scsi/esp-pci.c:283
#10 0x559b1d1f07f8 in esp_pci_dma_memory_read hw/scsi/esp-pci.c:296
#11 0x559b1d66fab1 in esp_do_dma hw/scsi/esp.c:576
#12 0x559b1d6746e1 in handle_ti hw/scsi/esp.c:845
...
Technically, the first one is a heap use-after-free, while the second a stack buffer overflow. They could be two different manifestations of the same issue; they both originate from handle_ti() and the root cause may be the same.
Heap uaf: ======= ======= ======= ======= ======= ======= ======= ======= == memcpy (/lib64/ libasan. so.6+0x39dd2) write_continue softmmu/ physmem. c:2781 physmem. c:2816 physmem. c:2908 physmem. c:2918 rw_relaxed include/ sysemu/ dma.h:8 sysemu/ dma.h:127 hw/pci/ pci.h:803 dma_memory_ rw hw/scsi/ esp-pci. c:283 dma_memory_ write hw/scsi/ esp-pci. c:302
=======
==129653==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290000b5000 at pc 0x7f0c3d947dd3 bp 0x7f0c13bfdac0 sp 0x7f0c13bfd270
READ of size 27 at 0x6290000b5000 thread T7
#0 0x7f0c3d947dd2 in __interceptor_
#1 0x562c1c7292b2 in flatview_
#2 0x562c1c729589 in flatview_write softmmu/
#3 0x562c1c729ef7 in address_space_write softmmu/
#4 0x562c1c729faf in address_space_rw softmmu/
#5 0x562c1c217754 in dma_memory_
#6 0x562c1c2177a1 in dma_memory_rw include/
#7 0x562c1c21791b in pci_dma_rw include/
#8 0x562c1c21b6e3 in esp_pci_
#9 0x562c1c21ba6e in esp_pci_
#10 0x562c1c428685 in esp_do_dma hw/scsi/esp.c:526
#11 0x562c1c429cb5 in handle_ti hw/scsi/esp.c:629
...
Stack bof: ======= ======= ======= ======= ======= ======= ======= ======= == overflow on address 0x7ffc8a90c300 at pc 0x559b1de0780e bp 0x7ffc8a90bd10 sp 0x7ffc8a90bd08 qemu/bswap. h:353 qemu/bswap. h:486 read_continue softmmu/ physmem. c:2841 physmem. c:2879 space_read_ full softmmu/ physmem. c:2892 physmem. c:2920 rw_relaxed include/ sysemu/ dma.h:88 sysemu/ dma.h:127 hw/pci/ pci.h:803 dma_memory_ rw hw/scsi/ esp-pci. c:283 dma_memory_ read hw/scsi/ esp-pci. c:296
=======
==138588==ERROR: AddressSanitizer: stack-buffer-
WRITE of size 4 at 0x7ffc8a90c300 thread T0
#0 0x559b1de0780d in stl_he_p include/
#1 0x559b1de07dec in stn_he_p include/
#2 0x559b1de23e47 in flatview_
#3 0x559b1de24215 in flatview_read softmmu/
#4 0x559b1de243b5 in address_
#5 0x559b1de2462c in address_space_rw softmmu/
#6 0x559b1d1ec514 in dma_memory_
#7 0x559b1d1ec561 in dma_memory_rw include/
#8 0x559b1d1ec6db in pci_dma_rw include/
#9 0x559b1d1f04a3 in esp_pci_
#10 0x559b1d1f07f8 in esp_pci_
#11 0x559b1d66fab1 in esp_do_dma hw/scsi/esp.c:576
#12 0x559b1d6746e1 in handle_ti hw/scsi/esp.c:845
...