You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
=================================================================
==111446==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000c2f2 at pc 0x0000004cb802 bp 0x7ffe11e8b650 sp 0x7ffe11e8b640
READ of size 1 at 0x60200000c2f2 thread T0
#0 0x4cb801 in jsi_utf_tocase src/jsiString.c:396 #1 0x4cc578 in StringToLowerCaseCmd src/jsiString.c:428 #2 0x4a82f8 in jsi_FuncCallSub src/jsiProto.c:244 #3 0x72059a in jsiFunctionSubCall src/jsiEval.c:790 #4 0x72059a in jsiEvalFunction src/jsiEval.c:825 #5 0x72059a in jsiEvalCodeSub src/jsiEval.c:1250 #6 0x73335f in jsi_evalcode src/jsiEval.c:2190 #7 0x4a93bd in jsi_FuncCallSub src/jsiProto.c:220 #8 0x720371 in jsiFunctionSubCall src/jsiEval.c:790 #9 0x720371 in jsiEvalFunction src/jsiEval.c:825 #10 0x720371 in jsiEvalCodeSub src/jsiEval.c:1250 #11 0x73335f in jsi_evalcode src/jsiEval.c:2190 #12 0x4a93bd in jsi_FuncCallSub src/jsiProto.c:220 #13 0x720371 in jsiFunctionSubCall src/jsiEval.c:790 #14 0x720371 in jsiEvalFunction src/jsiEval.c:825 #15 0x720371 in jsiEvalCodeSub src/jsiEval.c:1250 #16 0x73335f in jsi_evalcode src/jsiEval.c:2190 #17 0x736037 in jsi_evalStrFile src/jsiEval.c:2496 #18 0x47e0ee in Jsi_Main src/jsiInterp.c:917 #19 0x90be3e in jsi_main src/main.c:44 #20 0x7f09e6f8b83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) #21 0x418238 in _start (/home/keven/Fuzzing/jsish-1023/jsish+0x418238)
0x60200000c2f2 is located 0 bytes to the right of 2-byte region [0x60200000c2f0,0x60200000c2f2)
allocated by thread T0 here:
#0 0x7f09e7af7602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602) #1 0x4825c2 in Jsi_Malloc src/jsiUtils.c:52
SUMMARY: AddressSanitizer: heap-buffer-overflow src/jsiString.c:396 jsi_utf_tocase
Shadow bytes around the buggy address:
0x0c047fff9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[02]fa
0x0c047fff9860: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa
0x0c047fff9870: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
0x0c047fff9880: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff9890: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff98a0: fa fa 00 00 fa fa 04 fa fa fa 04 fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==111446==ABORTING
The text was updated successfully, but these errors were encountered:
Build environment:
Ubuntu 16.04
gcc 5.4.0
version: c95c897
build command:
export JSI__SANITIZE=1
make
test command: ./jsish poc
Target device:
Desktop Linux
POC
jsish-1021-000094.txt
Description
Below is the ASAN outputs.
=================================================================
==111446==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000c2f2 at pc 0x0000004cb802 bp 0x7ffe11e8b650 sp 0x7ffe11e8b640
READ of size 1 at 0x60200000c2f2 thread T0
#0 0x4cb801 in jsi_utf_tocase src/jsiString.c:396
#1 0x4cc578 in StringToLowerCaseCmd src/jsiString.c:428
#2 0x4a82f8 in jsi_FuncCallSub src/jsiProto.c:244
#3 0x72059a in jsiFunctionSubCall src/jsiEval.c:790
#4 0x72059a in jsiEvalFunction src/jsiEval.c:825
#5 0x72059a in jsiEvalCodeSub src/jsiEval.c:1250
#6 0x73335f in jsi_evalcode src/jsiEval.c:2190
#7 0x4a93bd in jsi_FuncCallSub src/jsiProto.c:220
#8 0x720371 in jsiFunctionSubCall src/jsiEval.c:790
#9 0x720371 in jsiEvalFunction src/jsiEval.c:825
#10 0x720371 in jsiEvalCodeSub src/jsiEval.c:1250
#11 0x73335f in jsi_evalcode src/jsiEval.c:2190
#12 0x4a93bd in jsi_FuncCallSub src/jsiProto.c:220
#13 0x720371 in jsiFunctionSubCall src/jsiEval.c:790
#14 0x720371 in jsiEvalFunction src/jsiEval.c:825
#15 0x720371 in jsiEvalCodeSub src/jsiEval.c:1250
#16 0x73335f in jsi_evalcode src/jsiEval.c:2190
#17 0x736037 in jsi_evalStrFile src/jsiEval.c:2496
#18 0x47e0ee in Jsi_Main src/jsiInterp.c:917
#19 0x90be3e in jsi_main src/main.c:44
#20 0x7f09e6f8b83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
#21 0x418238 in _start (/home/keven/Fuzzing/jsish-1023/jsish+0x418238)
0x60200000c2f2 is located 0 bytes to the right of 2-byte region [0x60200000c2f0,0x60200000c2f2)
allocated by thread T0 here:
#0 0x7f09e7af7602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x4825c2 in Jsi_Malloc src/jsiUtils.c:52
SUMMARY: AddressSanitizer: heap-buffer-overflow src/jsiString.c:396 jsi_utf_tocase
Shadow bytes around the buggy address:
0x0c047fff9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[02]fa
0x0c047fff9860: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa
0x0c047fff9870: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
0x0c047fff9880: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff9890: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff98a0: fa fa 00 00 fa fa 04 fa fa fa 04 fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==111446==ABORTING
The text was updated successfully, but these errors were encountered: