Closed
Description
Revision
Build
./tools/build.py --clean --debug --compile-flag=-fsanitize=address
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer
--compile-flag=-fno-common --compile-flag=-g
--strip=off --system-allocator=on --logging=on
--error-messages=on --profile=es2015-subset
OS
Linux 4.15.0-58-generic #64-Ubuntu x86_64 GNU/Linux
Test case
var arrb = new ArrayBuffer(1);
var arr = new Uint8Array(arrb);
arr.lastIndexOf(Number.NaN, -[4294967280]);Backtrace
Run with jerry poc.js
=================================================================
==65813==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf5f008d9 at pc 0x566f7ccd bp 0xffcc7168 sp 0xffcc7158
READ of size 1 at 0xf5f008d9 thread T0
#0 0x566f7ccc in ecma_get_typedarray_element /jerryscript/jerry-core/ecma/operations/ecma-typedarray-object.c:66
#1 0x566b4ea1 in ecma_builtin_typedarray_prototype_index_helper /jerryscript/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c:1755
#2 0x566b5047 in ecma_builtin_typedarray_prototype_last_index_of /jerryscript/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c:1797
#3 0x566aca7a in ecma_builtin_typedarray_prototype_dispatch_routine /jerryscript/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.inc.h:74
#4 0x566ab4bb in ecma_builtin_dispatch_routine /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1021
#5 0x566ab71c in ecma_builtin_dispatch_call /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1046
#6 0x566ce1b5 in ecma_op_function_call /jerryscript/jerry-core/ecma/operations/ecma-function-object.c:729
#7 0x5675d59a in opfunc_call /jerryscript/jerry-core/vm/vm.c:581
#8 0x5677294f in vm_execute /jerryscript/jerry-core/vm/vm.c:3636
#9 0x567731fe in vm_run /jerryscript/jerry-core/vm/vm.c:3756
#10 0x5675c400 in vm_run_global /jerryscript/jerry-core/vm/vm.c:282
#11 0x5661be50 in jerry_run /jerryscript/jerry-core/api/jerry.c:576
#12 0x5661863e in main /jerryscript/jerry-main/main-unix.c:743
#13 0xf7735e80 in __libc_start_main (/lib32/libc.so.6+0x18e80)
#14 0x56615f10 (/home/xyz/jerryscript/tmpmaster/jerry+0x15f10)
0xf5f008d9 is located 7 bytes to the left of 24-byte region [0xf5f008e0,0xf5f008f8)
allocated by thread T0 here:
#0 0xf79dbf34 in malloc (/usr/lib32/libasan.so.4+0xe5f34)
#1 0x566fd549 in jmem_heap_alloc /jerryscript/jerry-core/jmem/jmem-heap.c:258
#2 0x566fd5c1 in jmem_heap_gc_and_alloc_block /jerryscript/jerry-core/jmem/jmem-heap.c:293
#3 0x5664a589 in jmem_heap_alloc_block /jerryscript/jerry-core/jmem/jmem-heap.c:327
#4 0x5664a589 in ecma_alloc_extended_object /jerryscript/jerry-core/ecma/base/ecma-alloc.c:109
#5 0x5664a589 in ecma_create_object /jerryscript/jerry-core/ecma/base/ecma-helpers.c:81
#6 0x566a8778 in ecma_instantiate_builtin /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:385
#7 0x566a81c8 in ecma_builtin_get /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:299
#8 0x566bcd71 in ecma_arraybuffer_new_object /jerryscript/jerry-core/ecma/operations/ecma-arraybuffer-object.c:48
#9 0x566bd2eb in ecma_op_create_arraybuffer_object /jerryscript/jerry-core/ecma/operations/ecma-arraybuffer-object.c:149
#10 0x566688f9 in ecma_builtin_arraybuffer_dispatch_construct /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-arraybuffer.c:94
#11 0x566ab9b0 in ecma_builtin_dispatch_construct /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1080
#12 0x566cf7b4 in ecma_op_function_construct /jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1077
#13 0x5675dbb9 in opfunc_construct /jerryscript/jerry-core/vm/vm.c:665
#14 0x56772975 in vm_execute /jerryscript/jerry-core/vm/vm.c:3648
#15 0x567731fe in vm_run /jerryscript/jerry-core/vm/vm.c:3756
#16 0x5675c400 in vm_run_global /jerryscript/jerry-core/vm/vm.c:282
#17 0x5661be50 in jerry_run /jerryscript/jerry-core/api/jerry.c:576
#18 0x5661863e in main /jerryscript/jerry-main/main-unix.c:743
#19 0xf7735e80 in __libc_start_main (/lib32/libc.so.6+0x18e80)
SUMMARY: AddressSanitizer: heap-buffer-overflow /jerryscript/jerry-core/ecma/operations/ecma-typedarray-object.c:66 in ecma_get_typedarray_element
Shadow bytes around the buggy address:
0x3ebe00c0: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00
0x3ebe00d0: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa
0x3ebe00e0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
0x3ebe00f0: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
0x3ebe0100: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
=>0x3ebe0110: 00 00 00 fa fa fa 00 00 00 01 fa[fa]00 00 00 fa
0x3ebe0120: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
0x3ebe0130: 00 fa fa fa 00 00 03 fa fa fa 00 00 00 fa fa fa
0x3ebe0140: 00 00 00 fa fa fa 00 00 01 fa fa fa 00 00 00 fa
0x3ebe0150: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
0x3ebe0160: 00 fa fa fa 00 00 02 fa fa fa 00 00 00 00 fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==65813==ABORTING