SEGV at Jsi_TreeObjGetValue src/jsiObj.c:11

[kvenux]

Build environment:

Ubuntu 16.04
gcc 5.4.0
version: 73f457f
build command:
export JSI__SANITIZE=1
make
test command: ./jsish poc

POC

jsish-1024-000093.txt

Description

Below is the ASAN outputs.

ASAN:SIGSEGV

==86028==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000575f24 bp 0x62e000000400 sp 0x7ffe49e19ee0 T0)
#0 0x575f23 in Jsi_TreeObjGetValue src/jsiObj.c:11
#1 0x457481 in Jsi_ValueKeyPresent src/jsiValue.c:1133
#2 0x73c00c in jsiEvalCodeSub src/jsiEval.c:1632
#3 0x7506ec in jsi_evalcode src/jsiEval.c:2190
#4 0x4c517a in jsi_FuncCallSub src/jsiProto.c:220
#5 0x44bc0a in jsi_FunctionInvoke src/jsiFunc.c:771
#6 0x44bc0a in Jsi_FunctionInvoke src/jsiFunc.c:783
#7 0x4f7093 in jsi_ArrayReduceSubCmd src/jsiArray.c:641
#8 0x4c405d in jsi_FuncCallSub src/jsiProto.c:244
#9 0x73eaa4 in jsiFunctionSubCall src/jsiEval.c:790
#10 0x73eaa4 in jsiEvalFunction src/jsiEval.c:825
#11 0x73eaa4 in jsiEvalCodeSub src/jsiEval.c:1250
#12 0x7506ec in jsi_evalcode src/jsiEval.c:2190
#13 0x75317f in jsi_evalStrFile src/jsiEval.c:2496
#14 0x499c46 in Jsi_Main src/jsiInterp.c:917
#15 0xc0345a in jsi_main src/main.c:44
#16 0x7f6b078bb83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
#17 0x434f48 in _start (/home/keven/Fuzzing/jsish-1024/jsish+0x434f48)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/jsiObj.c:11 Jsi_TreeObjGetValue
==86028==ABORTING

[pcmacdon]

A commented out ASSERT should have been my clue that this function was unfinished. Great find, again.