[bug] : Dereferencing a null pointer allowed for Emscripten xeus-cpp kernel

[mcbarton]

If I run the following in the deployment I will get 0 returned to the notebook.

#include <iostream>

int main() {
    int* ptr = nullptr;
    std::cout << *ptr; 
    return 0;
}
main();

e.g.

Whereas if I was to compile this code

#include <iostream>

int main() {
    int* ptr = nullptr;
    std::cout << *ptr; 
    return 0;
}

and try to run it locally (on a native platform), I get a segmentation fault as expected.

[mcbarton]

This may be helpful https://emscripten.org/docs/debugging/Sanitizers.html as it has an entire section on Catching Null Dereference . They have this section since By default, with Emscripten, dereferencing a null pointer does not immediately cause a segmentation fault, unlike traditional platforms

[anutosh491]

Don't think this is a xeus-cpp-lite bug. I'd suggest closing and opening an issue on emscripten if this sound alarming. I lack the time to do a correctness check so not commenting on what should happen but this is what I see

(xeus-cpp-wasm-build) anutosh491@Anutoshs-MacBook-Air xeus-cpp % cat test.cpp
#include <iostream>

int main() {
    int* ptr = nullptr;
    std::cout << *ptr; 
    return 0;
}
main();%                                                                                                                                                    
(xeus-cpp-wasm-build) anutosh491@Anutoshs-MacBook-Air xeus-cpp % emcc test.cpp -o test.js \
  -sENVIRONMENT=node \
  -sEXIT_RUNTIME=1 \
  -O0 \
  -sASSERTIONS=2
(xeus-cpp-wasm-build) anutosh491@Anutoshs-MacBook-Air xeus-cpp % node test.js
0

[anutosh491]

Let's just close this ? cc @mcbarton

For anyone needing an explanation : in WebAssembly null is just address 0 in linear memory , so a null dereference reads memory[0] and prints 0 unless you enable trapping/instrumentation

The best one can do is

(xeus-cpp-wasm-build) anutosh491@Anutoshs-MacBook-Air xeus-cpp % cat test.cpp
#include <iostream>

int main() {
    int* ptr = nullptr;
    std::cout << *ptr; 
    return 0;
}
main();%
                                                                                                                                
(xeus-cpp-wasm-build) anutosh491@Anutoshs-MacBook-Air xeus-cpp % em++ test.cpp -o test_ubsan_abort.js \
  -O0 -g \
  -fsanitize=undefined \
  -fno-sanitize-recover=undefined \
  -sENVIRONMENT=node -sEXIT_RUNTIME=1

(xeus-cpp-wasm-build) anutosh491@Anutoshs-MacBook-Air xeus-cpp % node test_ubsan_abort.js
test.cpp:5:18: runtime error: load of null pointer of type 'int'

So if one really needs to catch these errors in xeus-cpp-lite they need to pass some UBSAN flags (Undefined Behaviour sanitizer) in the kernel.json.in like i've shown above ... but I don't think we need them as default kernel options as that's against default wasm behaviour.

[anutosh491]

I think we can close this based on the explanation above. Can open if needed (or if anyone is looking for a specific UBSAN Kernel)