Skip to content

Stack overflow, when evaluating Function('('.repeat(703)) #4397

@qarmin

Description

@qarmin

Rust code

fn check_file(path: &str) {
    let Ok(file_content) = fs::read(path) else {
        return;
    };
    println!("Checking file: {path}");
    let mut context = Context::default();

    let _result = context.eval(Source::from_bytes(&file_content));
}

when evaluating javascript code(at the bottom should be attached raw, not formatted file - github removes some non-printable characters, so copying from here may not work):

Function('('.repeat(703))

crashes with this info:

==763957==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd7319ccc0 (pc 0x55df910c2b3c bp 0x7ffd7319d2d0 sp 0x7ffd7319ccc0 T0)
    #0 0x55df910c2b3c in _$LT$boa_parser..parser..expression..BitwiseXORExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h12d3e62286342efe /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:78
    #1 0x55df910bfdcd in _$LT$boa_parser..parser..expression..BitwiseORExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h05e38b66a990308f /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:84:67
    #2 0x55df910c858e in _$LT$boa_parser..parser..expression..ShortCircuitExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h05b10a5f8d32d34b /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:252:18
    #3 0x55df9171855b in _$LT$boa_parser..parser..expression..assignment..conditional..ConditionalExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::hc7c07d948a3ac7ef /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/assignment/conditional.rs:64:14
    #4 0x55df9147e535 in _$LT$boa_parser..parser..expression..assignment..AssignmentExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h6691097ae9d11bc2 /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/assignment/mod.rs:155:14
    #5 0x55df910a6a2b in _$LT$boa_parser..parser..expression..Expression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h9dc8c4da82cb7d1b /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:144:14
    #6 0x55df91677866 in _$LT$boa_parser..parser..expression..primary..CoverParenthesizedExpressionAndArrowParameterList$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h2d310859d93ec27a /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/primary/mod.rs:375:22
    #7 0x55df916659ff in _$LT$boa_parser..parser..expression..primary..PrimaryExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::hd0ea679ee3d18c39 /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/primary/mod.rs:171:18
    #8 0x55df914a42e1 in _$LT$boa_parser..parser..expression..left_hand_side..member..MemberExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h5de6e93a0534e116 /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/left_hand_side/member.rs:227:18
    #9 0x55df910d1d05 in _$LT$boa_parser..parser..expression..left_hand_side..LeftHandSideExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h0c99831c4700e736 /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/left_hand_side/mod.rs:148:18
    #10 0x55df91020482 in _$LT$boa_parser..parser..expression..update..UpdateExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h8c3aef42790a074a /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/update.rs:149:14
    #11 0x55df913f33f1 in _$LT$boa_parser..parser..expression..assignment..exponentiation..ExponentiationExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::he458c4c1b81c2f6f /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/assignment/exponentiation.rs:76:71
    #12 0x55df910ce6f6 in _$LT$boa_parser..parser..expression..MultiplicativeExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h83bb1ed5e54dd19c /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:84:67
    #13 0x55df910bd5d4 in _$LT$boa_parser..parser..expression..AdditiveExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h5f5ae5f476144e9a /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:84:67
    #14 0x55df910a9ad4 in _$LT$boa_parser..parser..expression..ShiftExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::ha05e4496c6c74c7b /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:84:67
    #15 0x55df910c726e in _$LT$boa_parser..parser..expression..RelationalExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::hddf773d2b2cb6635 /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:552:70
    #16 0x55df910be5cc in _$LT$boa_parser..parser..expression..EqualityExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h1068e99348d1733a /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:84:67
    #17 0x55df910c1ccd in _$LT$boa_parser..parser..expression..BitwiseANDExpression$u20$as$u20$boa_parser..parser..TokenParser$LT$R$GT$$GT$::parse::h39ca43b84b519edf /home/runner/.cargo/git/checkouts/boa-126d820dff07bf57/8ea37c6/core/parser/src/parser/expression/mod.rs:84:67

compressed.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions