heap-use-after-free at Jsi_ObjFree src/jsiObj.c:333

[kvenux]

Build environment:

Ubuntu 16.04
gcc 5.4.0
version: 17c32ef
build command:
export JSI__SANITIZE=1
make
test command: ./jsish poc

POC

jsish-1021-000005.txt

Description

Below is the ASAN outputs.

==62343==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000016968 at pc 0x00000057992e bp 0x7ffc089887e0 sp 0x7ffc089887d0
READ of size 4 at 0x608000016968 thread T0
#0 0x57992d in Jsi_ObjFree src/jsiObj.c:333
#1 0x57a5b7 in Jsi_ObjDecrRefCount src/jsiObj.c:434
#2 0x454cf1 in ValueFree src/jsiValue.c:178
#3 0x454cf1 in Jsi_ValueFree src/jsiValue.c:199
#4 0x454fef in Jsi_DecrRefCount src/jsiValue.c:52
#5 0x5774f7 in DeleteTreeValue src/jsiObj.c:171
#6 0x595fda in Jsi_TreeEntryDelete src/jsiTree.c:636
#7 0x59ee73 in destroy_node src/jsiTree.c:496
#8 0x59ee73 in Jsi_TreeDelete src/jsiTree.c:515
#9 0x579387 in Jsi_ObjFree src/jsiObj.c:342
#10 0x57a5b7 in Jsi_ObjDecrRefCount src/jsiObj.c:434
#11 0x454cf1 in ValueFree src/jsiValue.c:178
#12 0x454cf1 in Jsi_ValueFree src/jsiValue.c:199
#13 0x454fef in Jsi_DecrRefCount src/jsiValue.c:52
#14 0x524735 in Jsi_OptionsFree src/jsiOptions.c:1383
#15 0x48a1f3 in jsiInterpDelete src/jsiInterp.c:1904
#16 0xc07b3f in jsi_main src/main.c:46
#17 0x7f17635b783f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
#18 0x434fc8 in _start (/home/keven/Fuzzing/jsish-1021/jsish+0x434fc8)

0x608000016968 is located 72 bytes inside of 96-byte region [0x608000016920,0x608000016980)
freed by thread T0 here:
#0 0x7f17641232ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
#1 0x478483 in regExpFree src/jsiInterp.c:585

previously allocated by thread T0 here:
#0 0x7f176412379a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
#1 0x49f5a4 in Jsi_Calloc src/jsiUtils.c:57
#2 0xca03b7 (/home/keven/Fuzzing/jsish-1021/jsish+0xca03b7)

SUMMARY: AddressSanitizer: heap-use-after-free src/jsiObj.c:333 Jsi_ObjFree
Shadow bytes around the buggy address:
0x0c107fffacd0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c107ffface0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c107fffacf0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c107fffad00: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c107fffad10: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c107fffad20: fa fa fa fa fd fd fd fd fd fd fd fd fd[fd]fd fd
0x0c107fffad30: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c107fffad40: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c107fffad50: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c107fffad60: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c107fffad70: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==62343==ABORTING

[pcmacdon]

Great find.