Skip to content

NULL dereference in scanner_reverse_info_list #3786

Closed

Description

@nszetei
JerryScript revision

6cd309b

Build platform

Ubuntu 20.04 LTS (Linux 5.4.0-31-generic x86_64)

Build steps
python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g \
--error-messages=on --debug --compile-flag=-g --strip=off --logging=on \
 --compile-flag=-fsanitize=address --stack-limit=15
Test case
function main() {
var v2 = new Float64Array(63797);
var v4 = "d".constructor;
var v6 = [1337,1337,1337,1337];
var v7 = [];
var v8 = {constructor:v6,a:v7};
var v9 = v8.a;
var v12 = 0;
v9.toString = v4;
var v14 = new Int16Array();
do {
    function v16(v17,v18,v19) {
        'use strict'
        var v20 = Int16Array.toLocaleString();
        var v22 = eval(v20);
    }
    var v24 = new Promise(v16);
    var v25 = v12 + 1;
    v12 = v25;
    v7[v25] = v14;
} while (v12 < 1337);
}
main();
Output
$ build/bin/jerry test.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==434582==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x55af4dd3f2b0 bp 0x7ffc7e016ab0 sp 0x7ffc7e016a80 T0)
==434582==The signal is caused by a READ memory access.
==434582==Hint: address points to the zero page.
    #0 0x55af4dd3f2af in scanner_reverse_info_list /tmp/jerryscript/jerry-core/parser/js/js-scanner-util.c:1557
    #1 0x55af4dd5150a in scanner_scan_all /tmp/jerryscript/jerry-core/parser/js/js-scanner.c:3217
    #2 0x55af4dd34f5e in parser_parse_source /tmp/jerryscript/jerry-core/parser/js/js-parser.c:2084
    #3 0x55af4dd38d76 in parser_parse_script /tmp/jerryscript/jerry-core/parser/js/js-parser.c:2697
..
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/jerryscript/jerry-core/parser/js/js-scanner-util.c:1557 in scanner_reverse_info_list
==434582==ABORTING
$ gdb -q -nx build/bin/jerry -ex 'r test.js'

Program received signal SIGSEGV, Segmentation fault.
0x00005555556422b0 in scanner_reverse_info_list (context_p=0x7fffffffca20) at /tmp/jerryscript/jerry-core/parser/js/js-scanner-util.c:1557
1557	  if (scanner_info_p->type == SCANNER_TYPE_END)
(gdb) x/i $rip
=> 0x5555556422b0 <scanner_reverse_info_list+133>:	movzbl 0x10(%rax),%eax
(gdb) i r rax
rax            0x0                 0

Activity

  1. added a commit that references this issue on May 25, 2020
    889b576
  2. self-assigned this
    on May 25, 2020
  3. added a commit that references this issue on May 26, 2020
    f198b39
  4. added 3 commits that reference this issue on May 26, 2020
    f8cca5a
    2de1838
    b4873d0
  5. added a commit that references this issue on May 27, 2020
    69f8e78
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugUndesired behaviour

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions