heap-use-after-free at DeleteTreeValue src/jsiObj.c:170

[kvenux]

Build environment:

Ubuntu 16.04
gcc 5.4.0
version: a6fc196
build command:
export JSI__SANITIZE=1
make
test command: ./jsish poc

Target device:
Desktop Linux

POC

jsish-1021-000042.txt

Description

Below is the ASAN outputs.

=================================================================
==139448==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300000ee30 at pc 0x000000577524 bp 0x7ffcb1fc18d0 sp 0x7ffcb1fc18c0
READ of size 4 at 0x60300000ee30 thread T0
#0 0x577523 in DeleteTreeValue src/jsiObj.c:170
#1 0x595fda in Jsi_TreeEntryDelete src/jsiTree.c:636
#2 0x59ee29 in destroy_node src/jsiTree.c:496
#3 0x59ee29 in destroy_node src/jsiTree.c:494
#4 0x59ee29 in Jsi_TreeDelete src/jsiTree.c:515
#5 0x579387 in Jsi_ObjFree src/jsiObj.c:342
#6 0x57a5b7 in Jsi_ObjDecrRefCount src/jsiObj.c:434
#7 0x454cf1 in ValueFree src/jsiValue.c:178
#8 0x454cf1 in Jsi_ValueFree src/jsiValue.c:199
#9 0x454fef in Jsi_DecrRefCount src/jsiValue.c:52
#10 0x4535ed in jsi_FuncObjFree src/jsiFunc.c:1077
#11 0x5798dc in Jsi_ObjFree src/jsiObj.c:322
#12 0x57a5b7 in Jsi_ObjDecrRefCount src/jsiObj.c:434
#13 0x454cf1 in ValueFree src/jsiValue.c:178
#14 0x454cf1 in Jsi_ValueFree src/jsiValue.c:199
#15 0x454fef in Jsi_DecrRefCount src/jsiValue.c:52
#16 0x524735 in Jsi_OptionsFree src/jsiOptions.c:1383
#17 0x48a1f3 in jsiInterpDelete src/jsiInterp.c:1904
#18 0xc07b3f in jsi_main src/main.c:46
#19 0x7f2eba2e983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
#20 0x434fc8 in _start (/home/keven/Fuzzing/jsish-1021/jsish+0x434fc8)

0x60300000ee30 is located 0 bytes inside of 32-byte region [0x60300000ee30,0x60300000ee50)
freed by thread T0 here:
#0 0x7f2ebae552ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
#1 0x454fef in Jsi_DecrRefCount src/jsiValue.c:52

previously allocated by thread T0 here:
#0 0x7f2ebae5579a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
#1 0x49f5a4 in Jsi_Calloc src/jsiUtils.c:57

SUMMARY: AddressSanitizer: heap-use-after-free src/jsiObj.c:170 DeleteTreeValue
Shadow bytes around the buggy address:
0x0c067fff9d70: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x0c067fff9d80: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x0c067fff9d90: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
0x0c067fff9da0: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x0c067fff9db0: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
=>0x0c067fff9dc0: fd fd fd fd fa fa[fd]fd fd fd fa fa fd fd fd fd
0x0c067fff9dd0: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00
0x0c067fff9de0: 00 00 fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x0c067fff9df0: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fd
0x0c067fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==139448==ABORTING

[pcmacdon]

Once again, need to free Interp options before tearing down support tables. Great find @kvenux : I don't know how your finding them all.

[kvenux]

Once again, need to free Interp options before tearing down support tables. Great find @kvenux : I don't know how your finding them all.

I am fuzzing this engine using a semantic aware approach. jsish is an important platform for my paper. Thanks for such a quick response.

[pcmacdon]

Very cool. I read about fuzzing, and sqlite uses it.