Security: Null pointer dereference in snapshot.h:216

[turnidge]

NULL Pointer Dereference in runtime/vm/snapshot.h (line 216):
   buffer_ = reinterpret_cast<uint8_t>(alloc_(NULL,
                                                 0,
                                     kBufferIncrementSize));
    ASSERT(*buffer_ != NULL);

triggered by the following PoC:

import("dart:coreimpl");

import("dart:core");

Math_rand()
{
  return (Math.random() * 0x80000000).toInt();
}

rand(var range)
{
  return ((Clock.now().toInt() + Math_rand()) % range);
}

main() {
  var tab = new List();
  for( int i = 0 ;; i++ )
  {
    tab.add(new SendPortImpl(rand(1000)));
    if((i % 1024) == 0)
    {
      var portno = rand((tab.length / 100) + 1);
      for( int j = 0; j < portno; j++ )
      {
        tab[j].send("w00t");
      }
      print("${tab.length}");
    }
  }
}

[turnidge]

Changed the title to: "Security: Null pointer dereference in snapshot.h:216".

[iposva-google]

Added Security label.

[iposva-google]

Set owner to @a-siva.
Added this to the M1 milestone.
Added Accepted label.

[a-siva]

Is this bug still valid?

SendPortImpl does not exist anymore instead we have _SendPortImpl which is a private class and cannot be accessed here the way it was being done.

[a-siva]

Set owner to @turnidge.

[turnidge]

Hi Siva,

I have written a new test which exhibits the old behavior...

#import('dart:isolate');

main() {
  var rp = new ReceivePort();
  rp.receive((msg, replyPort) {
      print('Received: $msg');
    });
  var ports = new List();
  while (true) {
    SendPort sp = rp.toSendPort();
    ports.add(sp);
    sp.send('hello');
  }
}

...The crash is...

random:runtime turnidge$ xcodebuild/DebugIA32/dart ~/dart/bug2.dart
dart(8544) malloc: *** mmap(size=16777216) failed (error code=12)
*** error: can't allocate region
*** set a breakpoint in malloc_error_break to debug
./vm/datastream.h:130: error: expected: *buffer_ != NULL
Abort trap: 6

...

Essentially, the question is this: what should the vm do if the call to ::realloc in datastream.h:130 fails? Most of our allocations in the system use new, which will terminate the program, I believe. Since this allocation uses ::realloc (indirectly) it may return NULL.

---

Set owner to @a-siva.

[turnidge]

Removed this from the M1 milestone.
Added this to the M2 milestone.

[iposva-google]

Removed this from the M2 milestone.
Added this to the M3 milestone.

[iposva-google]

Removed this from the M3 milestone.
Added this to the M4 milestone.

[larsbak]

Removed this from the M4 milestone.
Added this to the M5 milestone.

[iposva-google]

Removed Priority-Medium label.
Added Priority-Unassigned label.

[iposva-google]

Removed this from the M5 milestone.

[a-siva]

In our system we use new, malloc, calloc and realloc. I was under the impression that under chrome all these will terminate the program on failure to allocate memory.
Is this not a correct assumption?

[a-siva]

Marking bug as works as intended

---

Added AsDesigned label.