Fix crash in deserializer #602
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bnoordhuis
commented
Oct 16, 2024
| JSContext *ctx = JS_NewContext(rt); | ||
| if (!ctx) | ||
| exit(1); | ||
| JSValueConst val = JS_ReadObject(ctx, buf, len, /*flags*/0); |
There was a problem hiding this comment.
I just dread what libfuzzer is going to find when we pass JS_READ_OBJ_BYTECODE here...
| @@ -1,6 +1,45 @@ | |||
| import * as bjson from "bjson"; | |||
| import { assert } from "./assert.js"; | |||
|
|
|||
| function base64decode(s) { | |||
There was a problem hiding this comment.
This function is O(n*m) with respect to the length of the input (lots of indexOf calls) but performance hardly matters here. I could turn it into O(n) with a lookup table if the fuzzer ever finds a bug that takes a huge input.
saghul
approved these changes
Oct 16, 2024
saghul
reviewed
Oct 16, 2024
Check inside the deserializer that const atoms are indeed const, don't trust the input. The serializer only writes type 0 records for const atoms but the byte stream may have been corrupted or manipulated. Overlooked during review of c25aad7 ("Add ability to (de)serialize symbols") Found with libfuzzer and it found it _really_ fast. Great tool.
I completely missed that, looks like that landed around the time I was out sick. I may crib from it, fuzz-testing the regex engine was next on my list. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check inside the deserializer that const atoms are indeed const, don't trust the input. The serializer only writes type 0 records for const atoms but the byte stream may have been corrupted or manipulated.
Overlooked during review of c25aad7 ("Add ability to (de)serialize symbols")
Found with libfuzzer and it found it really fast. Great tool.
It already found more. For future reference: