Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Heap buffer overflow at moddable/xs/sources/xsDebug.c:783 #431

Closed
kvenux opened this issue Aug 31, 2020 · 1 comment
Closed

Heap buffer overflow at moddable/xs/sources/xsDebug.c:783 #431

kvenux opened this issue Aug 31, 2020 · 1 comment
Labels
confirmed issue reported has been reproduced fixed - please verify Issue has been fixed. Please verify and close.

Comments

@kvenux
Copy link

kvenux commented Aug 31, 2020

Build environment:
Ubuntu 16.04
gcc 5.4.0
xst version: de64c70 (git hash)
build command:
cd /path/to/moddable/xs/makefiles/lin
make
test command: ./xst poc

Target device:

Desktop Linux

POC

function f() {
var a = [10];
[{}] = a.slice(function () {
}, a.length);
a = a.toString(a);
var De65 = !9007199254740994;
var C44J = +-Infinity;
try {
f();
} catch (e) {
}
}
f();
var iGax = f();
var YeKj = f();
var KetZ = f();
var wPbt = f();
var sz6k = +-2147483649;
var Si7p = !1e+400;

Description
Below is the ASAN outputs. Heap buffer overflow at /moddable/xs/sources/xsDebug.c:783

image

@phoddie phoddie added the confirmed issue reported has been reproduced label Sep 1, 2020
@phoddie
Copy link
Collaborator

phoddie commented Sep 1, 2020

The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger.

@phoddie phoddie added the fixed - please verify Issue has been fixed. Please verify and close. label Sep 3, 2020
@kvenux kvenux closed this as completed Sep 4, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
confirmed issue reported has been reproduced fixed - please verify Issue has been fixed. Please verify and close.
Projects
None yet
Development

No branches or pull requests

2 participants