Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

stack-overflow in duktape/duk_hobject_assert.c:215 in duk_hthread_assert_valid #2551

Open
gandalf4a opened this issue Oct 10, 2023 · 0 comments
Open

stack-overflow in duktape/duk_hobject_assert.c:215 in duk_hthread_assert_valid #2551

gandalf4a opened this issue Oct 10, 2023 · 0 comments

Comments

@gandalf4a
Copy link

Version

$ git show
commit 47eedc5d53cdab72c5933148496b91142d5f0940 (HEAD -> master, origin/master, origin/HEAD)
Merge: f203a13e 7f66f09f
Author: Sami Vaarala <sami.vaarala@iki.fi>
Date:   Sun Sep 10 16:07:39 2023 +0300

Platform

$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Asan

duk_hobject_lookup.c:20:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_lookup.c:20:49 in 
duk_hobject_misc.c:124:70: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:124:70 in 
duk_hobject_misc.c:103:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:103:49 in 
duk_hobject_misc.c:104:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:104:49 in 
duk_hobject_resize.c:400:48: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:400:48 in 
duk_hobject_resize.c:401:46: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:401:46 in 
duk_hobject_misc.c:266:50: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:266:50 in 
duk_hobject_misc.c:267:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:267:49 in 
duk_heap_markandsweep.c:98:15: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_heap_markandsweep.c:98:15 in 
duk_util_bufwriter.c:27:16: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_util_bufwriter.c:27:16 in 
duk_util_bufwriter.c:29:22: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_util_bufwriter.c:29:22 in 
duk_hobject_lookup.c:105:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_lookup.c:105:49 in 
duk_js_compiler.c:2736:37: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_js_compiler.c:2736:37 in 
duk_hobject_resize.c:29:68: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:29:68 in 
duk_hobject_resize.c:1343:44: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:1343:44 in 
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==205711==ERROR: UndefinedBehaviorSanitizer: stack-overflow on address 0x7fff57761fe8 (pc 0x0000005ce326 bp 0x7fff57762030 sp 0x7fff57761ff0 T205711)
    #0 0x5ce326 in duk_hthread_assert_valid /home/user/fuzz/duktape/duk_hobject_assert.c:215
    #1 0x42a1e2 in duk_ctx_assert_valid /home/user/fuzz/duktape/duk_hobject_assert.c:225:2
    #2 0x5753ec in duk_is_valid_posidx /home/user/fuzz/duktape/duk_api_stack.c:338:2
    #3 0xa6b0fb in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1231:2
    #4 0xa6b0fb in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #5 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #6 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #7 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #8 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #9 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #10 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #11 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #12 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #13 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #14 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #15 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #16 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #17 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #18 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #19 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #20 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #21 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #22 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #23 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #24 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #25 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #26 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #27 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #28 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #29 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #30 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #31 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #32 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #33 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #34 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #35 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #36 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #37 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #38 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #39 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #40 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #41 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #42 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #43 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #44 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #45 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #46 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #47 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #48 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #49 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #50 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #51 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #52 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #53 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #54 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #55 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #56 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #57 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #58 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #59 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #60 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #61 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #62 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #63 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #64 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #65 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #66 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #67 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #68 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #69 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #70 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #71 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #72 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #73 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #74 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #75 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #76 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #77 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #78 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #79 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #80 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #81 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #82 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #83 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #84 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #85 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #86 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #87 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #88 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #89 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #90 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #91 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #92 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #93 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #94 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #95 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #96 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #97 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #98 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #99 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #100 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #101 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #102 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #103 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #104 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #105 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #106 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #107 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #108 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #109 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #110 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #111 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #112 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #113 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #114 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #115 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #116 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #117 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #118 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #119 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #120 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #121 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #122 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #123 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #124 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #125 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #126 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #127 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #128 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #129 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #130 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #131 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #132 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #133 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #134 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #135 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #136 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #137 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #138 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #139 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #140 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #141 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #142 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #143 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #144 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #145 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #146 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #147 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #148 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #149 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #150 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #151 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #152 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #153 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #154 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #155 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #156 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #157 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #158 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #159 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #160 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #161 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #162 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #163 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #164 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #165 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #166 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #167 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #168 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #169 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #170 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #171 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #172 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #173 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #174 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #175 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #176 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #177 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #178 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #179 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #180 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #181 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #182 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #183 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #184 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #185 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #186 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #187 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #188 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #189 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #190 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #191 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #192 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #193 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #194 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #195 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #196 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #197 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #198 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #199 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #200 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #201 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #202 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #203 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #204 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #205 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #206 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #207 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #208 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #209 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #210 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #211 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #212 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #213 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #214 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #215 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #216 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #217 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #218 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #219 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #220 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #221 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #222 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #223 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #224 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #225 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #226 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #227 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #228 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #229 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #230 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #231 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #232 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #233 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #234 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #235 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #236 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #237 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #238 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #239 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #240 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #241 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #242 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #243 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #244 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #245 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #246 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #247 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #248 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #249 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #250 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #251 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #252 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #253 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #254 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #255 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #256 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #257 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #258 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #259 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #260 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #261 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #262 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #263 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #264 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #265 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #266 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #267 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #268 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #269 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #270 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #271 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #272 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #273 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #274 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #275 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #276 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #277 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #278 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #279 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #280 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #281 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #282 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #283 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #284 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #285 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #286 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9
    #287 0x5d2d9b in duk_proxy_trap_check_strkey /home/user/fuzz/duktape/duk_hobject_proxy.c:71:9
    #288 0xa574bf in duk__get_own_prop_strkey_proxy_actual /home/user/fuzz/duktape/duk_prop_get.c:463:6
    #289 0xa585ee in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1332:12
    #290 0xa585ee in duk__prop_get_strkey_safe /home/user/fuzz/duktape/duk_prop_get.c:1402:9
    #291 0xa6cd62 in duk__prop_get_stroridx_helper /home/user/fuzz/duktape/duk_prop_get.c:1385:10
    #292 0xa6cd62 in duk__prop_get_strkey_unsafe /home/user/fuzz/duktape/duk_prop_get.c:1396:9
    #293 0xa6ad4f in duk__prop_get_str /home/user/fuzz/duktape/duk_prop_get.c:1411:9
    #294 0xa4fb7b in duk__prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1624:9
    #295 0x4a40b3 in duk_prop_getvalue_strkey_outidx /home/user/fuzz/duktape/duk_prop_get.c:1654:8
    #296 0x4c8b7c in duk_get_prop_stridx /home/user/fuzz/duktape/duk_api_object.c:116:9
    #297 0x5a7fbb in duk_get_prop_stridx_short_raw /home/user/fuzz/duktape/duk_api_object.c:120:9
    #298 0x5a7e44 in duk__proxy_trap_check /home/user/fuzz/duktape/duk_hobject_proxy.c:46:9

SUMMARY: UndefinedBehaviorSanitizer: stack-overflow /home/user/fuzz/duktape/duk_hobject_assert.c:215 in duk_hthread_assert_valid
==205711==ABORTING

Reproduce

./duk pocfile

POC File

var v0 = [];
var v2 = new Proxy(v0, v0);
var v3 = new Proxy(v2, v0);
for (var v5 in "undefined") {
    v3.__proto__ = v3;
}
// CRASH INFO
// ==========
// TERMSIG: 11
// STDERR:
// 
// STDOUT:
// 
// ARGS: /home/user/fuzz/duktape/build/duk-fuzzilli --reprl
// EXECUTION TIME: 135ms

Credit

Gandalf4a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@gandalf4a