Hello, I found a crash in the JerryScript parser.
JerryScript revision
355ab24
Build platform
Ubuntu 24.04.2
Build steps
python3 tools/build.py --clean --compile-flag=-fno-omit-frame-pointer --compile-flag=-fno-common --compile-flag=-fsanitize=address --compile-flag=-g --strip=off --lto=off --error-messages=on --logging=on --line-info=on --stack-limit=20
Test case
class C extends class {}
{
constructor() {
for (let in)Output
=================================================================
==213477==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x767488900078 at pc 0x5c49d2b87887 bp 0x7ffe55a869e0 sp 0x7ffe55a869d0
READ of size 1 at 0x767488900078 thread T0
#0 0x5c49d2b87886 in scanner_is_context_needed jerryscript/jerry-core/parser/js/js-scanner-util.c:2036
#1 0x5c49d2be8b71 in parser_push_block_context jerryscript/jerry-core/parser/js/js-parser-statm.c:333
#2 0x5c49d2becc08 in parser_parse_for_statement_start jerryscript/jerry-core/parser/js/js-parser-statm.c:1188
#3 0x5c49d2becc08 in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2851
#4 0x5c49d2b82077 in parser_parse_function jerryscript/jerry-core/parser/js/js-parser.c:2717
#5 0x5c49d2be14f4 in parser_parse_class_body jerryscript/jerry-core/parser/js/js-parser-expr.c:588
#6 0x5c49d2be14f4 in parser_parse_class jerryscript/jerry-core/parser/js/js-parser-expr.c:1137
#7 0x5c49d2beb77d in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2787
#8 0x5c49d2b815a7 in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:2280
#9 0x5c49d2b228eb in jerry_parse_common jerryscript/jerry-core/api/jerryscript.c:413
#10 0x5c49d2b22b19 in jerry_parse jerryscript/jerry-core/api/jerryscript.c:481
#11 0x5c49d2bf5ff0 in jerryx_source_parse_script jerryscript/jerry-ext/util/sources.c:52
#12 0x5c49d2bf6094 in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:63
#13 0x5c49d2b1cd89 in main jerryscript/jerry-main/main-desktop.c:156
#14 0x76748a62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#15 0x76748a62a28a in __libc_start_main_impl ../csu/libc-start.c:360
#16 0x5c49d2b1f4f4 in _start (jerryscript/build/bin/jerry+0x2a4f4) (BuildId: 17c3aadef0d80cfcfe75b8301417b3c3fd3fce2e)
Address 0x767488900078 is located in stack of thread T0 at offset 120 in frame
#0 0x5c49d2b7feca in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:1987
This frame has 5 object(s):
[32, 33) 'flags' (line 2041)
[48, 49) 'flags' (line 2063)
[64, 80) 'branch' (line 2253)
[96, 120) 'scanner_info_end' (line 2115) <== Memory access at offset 120 overflows this variable
[160, 768) 'context' (line 1988)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow jerryscript/jerry-core/parser/js/js-scanner-util.c:2036 in scanner_is_context_needed
Shadow bytes around the buggy address:
0x7674888ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7674888ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7674888ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7674888fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7674888fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x767488900000: f1 f1 f1 f1 01 f2 01 f2 00 00 f2 f2 00 00 00[f2]
0x767488900080: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
0x767488900100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x767488900180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x767488900200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x767488900280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==213477==ABORTINGIf I build with the debug flag in addition to the above build command, the test case produces an assertion failure instead:
ICE: Assertion '!has_context || context_p->next_scanner_info_p->type == SCANNER_TYPE_BLOCK' failed at /home/eric/Repos/llm-compiler-fuzz/pie/engines/jerry/jerryscript/jerry-core/parser/js/js-parser-statm.c(parser_parse_for_statement_start):1161.
Error: JERRY_FATAL_FAILED_ASSERTION
Aborted
Expected behavior
Running this test case through a different JS engine (JavaScriptCore) results in a lexing error at the keyword in as it expects a variable before in. Perhaps a similar check for JerryScript can gracefully handle this malformed code?
Hello, I found a crash in the JerryScript parser.
JerryScript revision
355ab24
Build platform
Ubuntu 24.04.2
Build steps
Test case
Output
================================================================= ==213477==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x767488900078 at pc 0x5c49d2b87887 bp 0x7ffe55a869e0 sp 0x7ffe55a869d0 READ of size 1 at 0x767488900078 thread T0 #0 0x5c49d2b87886 in scanner_is_context_needed jerryscript/jerry-core/parser/js/js-scanner-util.c:2036 #1 0x5c49d2be8b71 in parser_push_block_context jerryscript/jerry-core/parser/js/js-parser-statm.c:333 #2 0x5c49d2becc08 in parser_parse_for_statement_start jerryscript/jerry-core/parser/js/js-parser-statm.c:1188 #3 0x5c49d2becc08 in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2851 #4 0x5c49d2b82077 in parser_parse_function jerryscript/jerry-core/parser/js/js-parser.c:2717 #5 0x5c49d2be14f4 in parser_parse_class_body jerryscript/jerry-core/parser/js/js-parser-expr.c:588 #6 0x5c49d2be14f4 in parser_parse_class jerryscript/jerry-core/parser/js/js-parser-expr.c:1137 #7 0x5c49d2beb77d in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2787 #8 0x5c49d2b815a7 in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:2280 #9 0x5c49d2b228eb in jerry_parse_common jerryscript/jerry-core/api/jerryscript.c:413 #10 0x5c49d2b22b19 in jerry_parse jerryscript/jerry-core/api/jerryscript.c:481 #11 0x5c49d2bf5ff0 in jerryx_source_parse_script jerryscript/jerry-ext/util/sources.c:52 #12 0x5c49d2bf6094 in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:63 #13 0x5c49d2b1cd89 in main jerryscript/jerry-main/main-desktop.c:156 #14 0x76748a62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #15 0x76748a62a28a in __libc_start_main_impl ../csu/libc-start.c:360 #16 0x5c49d2b1f4f4 in _start (jerryscript/build/bin/jerry+0x2a4f4) (BuildId: 17c3aadef0d80cfcfe75b8301417b3c3fd3fce2e) Address 0x767488900078 is located in stack of thread T0 at offset 120 in frame #0 0x5c49d2b7feca in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:1987 This frame has 5 object(s): [32, 33) 'flags' (line 2041) [48, 49) 'flags' (line 2063) [64, 80) 'branch' (line 2253) [96, 120) 'scanner_info_end' (line 2115) <== Memory access at offset 120 overflows this variable [160, 768) 'context' (line 1988) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow jerryscript/jerry-core/parser/js/js-scanner-util.c:2036 in scanner_is_context_needed Shadow bytes around the buggy address: 0x7674888ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7674888ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7674888ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7674888fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7674888fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x767488900000: f1 f1 f1 f1 01 f2 01 f2 00 00 f2 f2 00 00 00[f2] 0x767488900080: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 0x767488900100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x767488900180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x767488900200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x767488900280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==213477==ABORTINGIf I build with the debug flag in addition to the above build command, the test case produces an assertion failure instead:
ICE: Assertion '!has_context || context_p->next_scanner_info_p->type == SCANNER_TYPE_BLOCK' failed at /home/eric/Repos/llm-compiler-fuzz/pie/engines/jerry/jerryscript/jerry-core/parser/js/js-parser-statm.c(parser_parse_for_statement_start):1161. Error: JERRY_FATAL_FAILED_ASSERTION AbortedExpected behavior
Running this test case through a different JS engine (JavaScriptCore) results in a lexing error at the keyword
inas it expects a variable beforein. Perhaps a similar check for JerryScript can gracefully handle this malformed code?