Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

heap-buffer-overflow in ecma_get_typedarray_element #3129

Closed
mka-sec opened this issue Sep 17, 2019 · 1 comment · Fixed by #3156
Closed

heap-buffer-overflow in ecma_get_typedarray_element #3129

mka-sec opened this issue Sep 17, 2019 · 1 comment · Fixed by #3156
Labels
bug Undesired behaviour ES2015 Related to ES2015 features

Comments

@mka-sec
Copy link

mka-sec commented Sep 17, 2019

Revision

c05686b

Build

./tools/build.py --clean --debug --compile-flag=-fsanitize=address
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer
--compile-flag=-fno-common --compile-flag=-g
--strip=off --system-allocator=on --logging=on
--error-messages=on --profile=es2015-subset

OS

Linux 4.15.0-58-generic #64-Ubuntu x86_64 GNU/Linux

Test case
var arrb = new ArrayBuffer(1);
var arr = new Uint8Array(arrb);
arr.lastIndexOf(Number.NaN, -[4294967280]);
Backtrace

Run with jerry poc.js

=================================================================
==65813==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf5f008d9 at pc 0x566f7ccd bp 0xffcc7168 sp 0xffcc7158
READ of size 1 at 0xf5f008d9 thread T0
    #0 0x566f7ccc in ecma_get_typedarray_element /jerryscript/jerry-core/ecma/operations/ecma-typedarray-object.c:66
    #1 0x566b4ea1 in ecma_builtin_typedarray_prototype_index_helper /jerryscript/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c:1755
    #2 0x566b5047 in ecma_builtin_typedarray_prototype_last_index_of /jerryscript/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c:1797
    #3 0x566aca7a in ecma_builtin_typedarray_prototype_dispatch_routine /jerryscript/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.inc.h:74
    #4 0x566ab4bb in ecma_builtin_dispatch_routine /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1021
    #5 0x566ab71c in ecma_builtin_dispatch_call /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1046
    #6 0x566ce1b5 in ecma_op_function_call /jerryscript/jerry-core/ecma/operations/ecma-function-object.c:729
    #7 0x5675d59a in opfunc_call /jerryscript/jerry-core/vm/vm.c:581
    #8 0x5677294f in vm_execute /jerryscript/jerry-core/vm/vm.c:3636
    #9 0x567731fe in vm_run /jerryscript/jerry-core/vm/vm.c:3756
    #10 0x5675c400 in vm_run_global /jerryscript/jerry-core/vm/vm.c:282
    #11 0x5661be50 in jerry_run /jerryscript/jerry-core/api/jerry.c:576
    #12 0x5661863e in main /jerryscript/jerry-main/main-unix.c:743
    #13 0xf7735e80 in __libc_start_main (/lib32/libc.so.6+0x18e80)
    #14 0x56615f10  (/home/xyz/jerryscript/tmpmaster/jerry+0x15f10)

0xf5f008d9 is located 7 bytes to the left of 24-byte region [0xf5f008e0,0xf5f008f8)
allocated by thread T0 here:
    #0 0xf79dbf34 in malloc (/usr/lib32/libasan.so.4+0xe5f34)
    #1 0x566fd549 in jmem_heap_alloc /jerryscript/jerry-core/jmem/jmem-heap.c:258
    #2 0x566fd5c1 in jmem_heap_gc_and_alloc_block /jerryscript/jerry-core/jmem/jmem-heap.c:293
    #3 0x5664a589 in jmem_heap_alloc_block /jerryscript/jerry-core/jmem/jmem-heap.c:327
    #4 0x5664a589 in ecma_alloc_extended_object /jerryscript/jerry-core/ecma/base/ecma-alloc.c:109
    #5 0x5664a589 in ecma_create_object /jerryscript/jerry-core/ecma/base/ecma-helpers.c:81
    #6 0x566a8778 in ecma_instantiate_builtin /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:385
    #7 0x566a81c8 in ecma_builtin_get /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:299
    #8 0x566bcd71 in ecma_arraybuffer_new_object /jerryscript/jerry-core/ecma/operations/ecma-arraybuffer-object.c:48
    #9 0x566bd2eb in ecma_op_create_arraybuffer_object /jerryscript/jerry-core/ecma/operations/ecma-arraybuffer-object.c:149
    #10 0x566688f9 in ecma_builtin_arraybuffer_dispatch_construct /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-arraybuffer.c:94
    #11 0x566ab9b0 in ecma_builtin_dispatch_construct /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1080
    #12 0x566cf7b4 in ecma_op_function_construct /jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1077
    #13 0x5675dbb9 in opfunc_construct /jerryscript/jerry-core/vm/vm.c:665
    #14 0x56772975 in vm_execute /jerryscript/jerry-core/vm/vm.c:3648
    #15 0x567731fe in vm_run /jerryscript/jerry-core/vm/vm.c:3756
    #16 0x5675c400 in vm_run_global /jerryscript/jerry-core/vm/vm.c:282
    #17 0x5661be50 in jerry_run /jerryscript/jerry-core/api/jerry.c:576
    #18 0x5661863e in main /jerryscript/jerry-main/main-unix.c:743
    #19 0xf7735e80 in __libc_start_main (/lib32/libc.so.6+0x18e80)

SUMMARY: AddressSanitizer: heap-buffer-overflow /jerryscript/jerry-core/ecma/operations/ecma-typedarray-object.c:66 in ecma_get_typedarray_element
Shadow bytes around the buggy address:
  0x3ebe00c0: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00
  0x3ebe00d0: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa
  0x3ebe00e0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x3ebe00f0: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x3ebe0100: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
=>0x3ebe0110: 00 00 00 fa fa fa 00 00 00 01 fa[fa]00 00 00 fa
  0x3ebe0120: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x3ebe0130: 00 fa fa fa 00 00 03 fa fa fa 00 00 00 fa fa fa
  0x3ebe0140: 00 00 00 fa fa fa 00 00 01 fa fa fa 00 00 00 fa
  0x3ebe0150: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x3ebe0160: 00 fa fa fa 00 00 02 fa fa fa 00 00 00 00 fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==65813==ABORTING
@rerobika rerobika added bug Undesired behaviour ES2015 Related to ES2015 features labels Sep 20, 2019
@rerobika rerobika assigned rerobika and unassigned rerobika Sep 20, 2019
@rerobika
Copy link
Member

cc @szilagyiadam .

szilagyiadam added a commit to szilagyiadam/jerryscript that referenced this issue Sep 24, 2019
@szilagyiadam
Add new check for a special corner case to typedarray lastIndexOf
1affd7d 
Fixes jerryscript-project#3129
We need to check if we use the lastIndexOf method  and if the second
argument is a number, negative, and its absolute value is bigger
than the length, then  we should return with -1.

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]
@szilagyiadam szilagyiadam mentioned this issue Sep 24, 2019
Merged
szilagyiadam added a commit to szilagyiadam/jerryscript that referenced this issue Sep 24, 2019
@szilagyiadam
Add new check for a special corner case to typedarray lastIndexOf
b252eba 
Fixes jerryscript-project#3129
We need to check if we use the lastIndexOf method  and if the second
argument is a number, negative, and its absolute value is bigger
than the length, then  we should return with -1.

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]
szilagyiadam added a commit to szilagyiadam/jerryscript that referenced this issue Sep 25, 2019
@szilagyiadam
Add new check for a special corner case to typedarray lastIndexOf
096c956 
Fixes jerryscript-project#3129
We need to check if we use the lastIndexOf method  and if the second
argument is a number, negative, and its absolute value is bigger
than the length, then  we should return with -1.

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]
szilagyiadam added a commit to szilagyiadam/jerryscript that referenced this issue Sep 26, 2019
@szilagyiadam
Add new check for a special corner case to typedarray lastIndexOf
ef0d06c 
Fixes jerryscript-project#3129
We need to check if we use the lastIndexOf method  and if the second
argument is a number, negative, and its absolute value is bigger
than the length, then  we should return with -1.

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]
dbatyai pushed a commit that referenced this issue Sep 27, 2019
@szilagyiadam @dbatyai
Add new check for a special corner case to typedarray lastIndexOf (#3156
711b06d 
)

Fixes #3129
We need to check if we use the lastIndexOf method  and if the second
argument is a number, negative, and its absolute value is bigger
than the length, then  we should return with -1.

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Undesired behaviour ES2015 Related to ES2015 features
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add new check for a special corner case to typedarray lastIndexOf szilagyiadam/jerryscript
2 participants
@mka-sec @rerobika