Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEGV in njs_sprintf.c:424:19 #553

Closed
yype opened this issue Jun 20, 2022 · 0 comments
Closed

SEGV in njs_sprintf.c:424:19 #553

yype opened this issue Jun 20, 2022 · 0 comments
Assignees
Labels

Comments

@yype
Copy link

yype commented Jun 20, 2022

Hi, the following PoC triggers a crash (related to string fmt?) in the latest commit.

(function() {
while ([])
  try {
      break
      try {
        return } catch (a) {}
    } catch (b) {}
}())

Environment:

Commit: e008f7ae22834ff1173b7a0067b14c821102018d
System: Ubuntu 18.04.6 LTS

ASan output:

/njs/njs_asan/build/njs ./poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==177164==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000803 (pc 0x7ffff6807384 bp 0x7fffffffb790 sp 0x7fffffffaf48 T0)
==177164==The signal is caused by a READ memory access.
==177164==Hint: address points to the zero page.
    #0 0x7ffff6807384  (/lib/x86_64-linux-gnu/libc.so.6+0xbb384)
    #1 0x497d01 in __asan_memcpy (/njs/njs_asan/build/njs+0x497d01)
    #2 0x4d2b96 in njs_vsprintf /njs/njs_asan/src/njs_sprintf.c:424:19
    #3 0x541fe6 in njs_error_fmt_new /njs/njs_asan/src/njs_error.c:69:13
    #4 0x4ea1a7 in njs_vmcode_error /njs/njs_asan/src/njs_vmcode.c
    #5 0x4e1c7e in njs_vmcode_interpreter /njs/njs_asan/src/njs_vmcode.c:993:17
    #6 0x52dcdf in njs_function_lambda_call /njs/njs_asan/src/njs_function.c:693:11
    #7 0x52d6d0 in njs_function_frame_invoke /njs/njs_asan/src/njs_function.c:780:16
    #8 0x4e39ec in njs_vmcode_interpreter /njs/njs_asan/src/njs_vmcode.c:799:23
    #9 0x4ddf17 in njs_vm_start /njs/njs_asan/src/njs_vm.c:539:11
    #10 0x4cb35b in njs_process_script /njs/njs_asan/src/njs_shell.c:890:19
    #11 0x4cbb68 in njs_process_file /njs/njs_asan/src/njs_shell.c:619:11
    #12 0x4ca1fc in main /njs/njs_asan/src/njs_shell.c:303:15
    #13 0x7ffff676dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #14 0x41d9a9 in _start (/njs/njs_asan/build/njs+0x41d9a9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xbb384) 
==177164==ABORTING
@xeioex xeioex added the bug label Jun 21, 2022
@xeioex xeioex self-assigned this Jun 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants