New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Null pointer dereference in jmem-heap #2435
Comments
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Jul 30, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Jul 31, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Jul 31, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Jul 31, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Aug 1, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Aug 1, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Aug 1, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
DanielBallaSZTE
pushed a commit
to DanielBallaSZTE/jerryscript
that referenced
this issue
Aug 1, 2018
Fixes jerryscript-project#2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
yichoi
pushed a commit
that referenced
this issue
Aug 1, 2018
Fixes #2435. JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Jerry Version:
f86d745
Build command:
python tools/build.py --profile=es2015-subset --jerry-libc=OFF --clean --strip OFF --compile-flag="-g" --compile-flag="-fsanitize=address"OS:
Ubuntu 16.04
Test case:
(new Int8Array(0)).filter(parseInt)Result:
It seems that this bug is caused by triggering undefined behavior at jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c:598. The second passed argument is NULL. This causes NULL dereference and allows GCC to optimize out subsequent checks for NULL. This further causes writing to null pointer, which results in a segmentation fault. Note, that because this bug occurs due to gcc optimizing out a check for NULL, this may not be reproducible with a debug build.
Please confirm if you can reproduce this issue.
This bug was discovered by Marcin Dominiak and Wojciech Rauner.
The text was updated successfully, but these errors were encountered: