Stack-overflow at jerry-core/parser/js/js-scanner-util.c:2363

[ericliuu]

Hello,

I found a parser crash when running some malformed JavaScript.

JerryScript revision

355ab24

Build platform

Ubuntu 24.04.2

Build steps

python3 tools/build.py --clean --compile-flag=-fno-omit-frame-pointer --compile-flag=-fno-common --compile-flag=-fsanitize=address --compile-flag=-g --strip=off --lto=off --error-messages=on --logging=on --line-info=on --stack-limit=20

Test case

class Z {
  static {}}
}
function* g1() {}

Output

=================================================================
==3318425==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7be840700078 at pc 0x59819774baad bp 0x7fffba5333a0 sp 0x7fffba533390
READ of size 1 at 0x7be840700078 thread T0
    #0 0x59819774baac in scanner_create_variables jerryscript/jerry-core/parser/js/js-scanner-util.c:2363
    #1 0x59819771a8ec in parser_parse_function_arguments jerryscript/jerry-core/parser/js/js-parser.c:1611
    #2 0x59819772e697 in parser_parse_function jerryscript/jerry-core/parser/js/js-parser.c:2685
    #3 0x5981978a84ff in parser_parse_function_statement jerryscript/jerry-core/parser/js/js-parser-statm.c:756
    #4 0x5981978b2456 in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2809
    #5 0x59819772ad8d in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:2280
    #6 0x5981975e71cb in jerry_parse_common jerryscript/jerry-core/api/jerryscript.c:413
    #7 0x5981975e71cb in jerry_parse jerryscript/jerry-core/api/jerryscript.c:481
    #8 0x5981978e48cf in jerryx_source_parse_script jerryscript/jerry-ext/util/sources.c:52
    #9 0x5981978e4be7 in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:63
    #10 0x5981975ce574 in main jerryscript/jerry-main/main-desktop.c:156
    #11 0x7be84242a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #12 0x7be84242a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #13 0x5981975dae64 in _start (jerryscript/build/bin/jerry+0x37e64) (BuildId: 32a61dd38d493b1ff03e62f3a6f61340680c121e)

Address 0x7be840700078 is located in stack of thread T0 at offset 120 in frame
    #0 0x59819772872f in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:1987

  This frame has 6 object(s):
    [32, 33) 'flags' (line 2041)
    [48, 49) 'flags' (line 2063)
    [64, 80) 'branch' (line 2253)
    [96, 120) 'scanner_info_end' (line 2115) <== Memory access at offset 120 overflows this variable
    [160, 184) 'literal_iterator' (line 1568)
    [224, 832) 'context' (line 1988)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow jerryscript/jerry-core/parser/js/js-scanner-util.c:2363 in scanner_create_variables
Shadow bytes around the buggy address:
  0x7be8406ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7be8406ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7be8406ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7be8406fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7be8406fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7be840700000: f1 f1 f1 f1 01 f2 01 f2 00 00 f2 f2 00 00 00[f2]
  0x7be840700080: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 f2 00 00 00 00
  0x7be840700100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7be840700180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7be840700200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7be840700280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3318425==ABORTING

With the --debug flag:

ICE: Assertion 'context_p->scope_stack_top >= 2' failed at /home/eric/Repos/llm-compiler-fuzz/pie/engines/jerry/jerryscript/jerry-core/parser/js/js-parser-statm.c(parser_parse_function_statement):691.
Error: JERRY_FATAL_FAILED_ASSERTION

Expected behavior

Should result in a parser error instead of a crash