SEGV /src/njs/src/njs_vm.c in njs_vm_compile

[gtt1995]

poc https://github.com/gtt1995/poc/tree/main/njs

root@c525fa59cf24:/workspace/out-random/njs# ./njs_process_script_fuzzer crash-6342d917e3273eef2cd159c58e0f02f1a4bab05c
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1183854156
INFO: Loaded 1 modules (28625 inline 8-bit counters): 28625 [0x9b0f38, 0x9b7f09),
INFO: Loaded 1 PC tables (28625 PCs): 28625 [0x9b7f10,0xa27c20),
./njs_process_script_fuzzer: Running 1 inputs 1 time(s) each.

Running: crash-6342d917e3273eef2cd159c58e0f02f1a4bab05c
AddressSanitizer:DEADLYSIGNAL

==6271==ERROR: AddressSanitizer: SEGV on unknown address 0x000000001920 (pc 0x0000005a5c26 bp 0x7ffd9321e950 sp 0x7ffd9321e880 T0)
==6271==The signal is caused by a READ memory access.
SCARINESS: 20 (wild-addr-read)
#0 0x5a5c26 in njs_vm_compile /src/njs/src/njs_vm.c
#1 0x59006e in njs_process_script /src/njs/src/njs_shell.c:877:11
#2 0x59006e in LLVMFuzzerTestOneInput /src/njs/src/njs_shell.c:673:16
#3 0x52a5ee in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/glibfuzzer/FuzzerLoop.cpp:605:15
#4 0x4d9c38 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/glibfuzzer/FuzzerDriver.cpp:323:6
#5 0x4e7b49 in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) /src/glibfuzzer/FuzzerDriver.cpp:856:9
#6 0x4d9287 in main /src/glibfuzzer/FuzzerMain.cpp:20:10
#7 0x7feac3d3b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#8 0x41f9bd in _start (out-random/njs/njs_process_script_fuzzer+0x41f9bd)

DEDUP_TOKEN: njs_vm_compile--njs_process_script--LLVMFuzzerTestOneInput
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /src/njs/src/njs_vm.c in njs_vm_compile
==6271==ABORTING

[xeioex]

@gtt1995

Here is the fix: https://gist.github.com/ad83d067bd1e57d56c0069aec122913e