New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SEGV njs_scope.h:74:12 Out-of-bounds Read in njs_scope_value #506
Comments
This was referenced Jun 2, 2022
|
The patch # HG changeset patch
# Parent d63163569c25cb90fe654f0fedefde43553f833a
Fixed njs_vmcode_interpreter() when await fails.
Previously, while interpreting a user function, njs_vmcode_interpreter()
might return prematurely when an error happens in await instruction.
This is not correct because the current frame has to be unwound (or
exception caught) first.
The fix is exit through only 5 appropriate exit points to ensure
proper unwinding.
The patch correctly fixes issue reported in 07ef6c1f04f1 (0.7.3).
This closes #506 issue on Github.
diff --git a/src/njs_vmcode.c b/src/njs_vmcode.c
--- a/src/njs_vmcode.c
+++ b/src/njs_vmcode.c
@@ -858,7 +858,12 @@ next:
njs_vmcode_debug(vm, pc, "EXIT AWAIT");
- return njs_vmcode_await(vm, await, promise_cap, async_ctx);
+ ret = njs_vmcode_await(vm, await, promise_cap, async_ctx);
+ if (njs_slow_path(ret == NJS_ERROR)) {
+ goto error;
+ }
+
+ return ret;
case NJS_VMCODE_TRY_START:
ret = njs_vmcode_try_start(vm, value1, value2, pc);
@@ -1923,6 +1928,7 @@ njs_vmcode_await(njs_vm_t *vm, njs_vmcod
value = njs_scope_valid_value(vm, await->retval);
if (njs_slow_path(value == NULL)) {
+ njs_internal_error(vm, "await->retval is invalid");
return NJS_ERROR;
}
|
This was referenced Jun 2, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Environment
Commit : 9f4ebc96148308a8ce12f2b54432c87e6d78b881 Version : 0.7.4 Build : ./configure --cc=clang --address-sanitizer=YES makeProof of concept
Minified
Stack dump
Credit
dramthy(@topsec alpha)
The text was updated successfully, but these errors were encountered: