We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Escargot
Build Steps
cmake -DCMAKE_CXX_FLAGS=-fsanitize=address -DESCARGOT_MODE=debug -DESCARGOT_OUTPUT=shell -GNinja
Describe the bug Stack overflow
Test case
var a = " " ; for ( var e = 0 ; e < 1000.0 ; e ++ ) { a += " a? " ; } " test ". match ( RegExp ( a ) ) ; var r = " " ; for ( var e = 0 ; e < 64 ; e ++ ) { r += " ( a? | b? | c? | d? | e? | f? | g? ) " ; } " test ". match ( RegExp ( RegExp ( r ) ) ) ; Math. fround ( 1e3 ) ; var t = " a " ; for ( var e = 0 ; e < 100000.0 ; e ++ ) { t = " ( " + t + " ) a " ; } " test ". match ( RegExp ( t ) ) ;
// poc.js var t = " a " ; for ( var e = 0 ; e < 100000.0 ; e ++ ) { t = " ( " + t + " ) a " ; } " test ". match ( RegExp ( t ) ) ;
Execution steps & Output
$ ./escargot poc.js AddressSanitizer:DEADLYSIGNAL ================================================================= ==3488637==ERROR: AddressSanitizer: stack-overflow on address 0x7ffed286ffe8 (pc 0x55cc14280258 bp 0x7ffed28700f0 sp 0x7ffed286ffc0 T0) #0 0x55cc14280257 in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:798 #1 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #2 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #3 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #4 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #5 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #6 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #7 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #8 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 ... ... #238 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #239 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #240 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #241 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #242 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #243 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #244 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #245 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #246 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 #247 0x55cc142817c3 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:929 #248 0x55cc14280c9b in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) third_party/yarr/YarrPattern.cpp:863 SUMMARY: AddressSanitizer: stack-overflow third_party/yarr/YarrPattern.cpp:798 in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) ==3488637==ABORTING
when executed in release mode
Output
Segmentation fault
Expected behavior We would expect to detect an out of memory.
Credits: @Ye0nny, @EJueon
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Escargot
Build Steps
Describe the bug
Stack overflow
Test case
testcase
Execution steps & Output
when executed in release mode
Output
Expected behavior
We would expect to detect an out of memory.
Credits: @Ye0nny, @EJueon
The text was updated successfully, but these errors were encountered: