Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

stack-overflow in duktape/duk_js_call.c:1570 in duk__call_setup_act_not_tailcall #2552

Open
gandalf4a opened this issue Oct 10, 2023 · 0 comments
Open

stack-overflow in duktape/duk_js_call.c:1570 in duk__call_setup_act_not_tailcall #2552

gandalf4a opened this issue Oct 10, 2023 · 0 comments

Comments

@gandalf4a
Copy link

Version

$ git show
commit 47eedc5d53cdab72c5933148496b91142d5f0940 (HEAD -> master, origin/master, origin/HEAD)
Merge: f203a13e 7f66f09f
Author: Sami Vaarala <sami.vaarala@iki.fi>
Date:   Sun Sep 10 16:07:39 2023 +0300

Platform

$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Asan

duk_hobject_lookup.c:20:49: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_lookup.c:20:49 in ​
duk_hobject_misc.c:124:70: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:124:70 in ​
duk_hobject_misc.c:103:49: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:103:49 in ​
duk_hobject_misc.c:104:49: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:104:49 in ​
duk_hobject_resize.c:400:48: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:400:48 in ​
duk_hobject_resize.c:401:46: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:401:46 in ​
duk_hobject_misc.c:266:50: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:266:50 in ​
duk_hobject_misc.c:267:49: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:267:49 in ​
duk_heap_markandsweep.c:98:15: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_heap_markandsweep.c:98:15 in ​
duk_util_bufwriter.c:27:16: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_util_bufwriter.c:27:16 in ​
duk_util_bufwriter.c:29:22: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_util_bufwriter.c:29:22 in ​
duk_hobject_lookup.c:105:49: runtime error: applying zero offset to null pointer​
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_lookup.c:105:49 in ​
UndefinedBehaviorSanitizer:DEADLYSIGNAL​
==262958==ERROR: UndefinedBehaviorSanitizer: stack-overflow on address 0x7ffc96567e28 (pc 0x00000086b6e7 bp 0x7ffc96568310 sp 0x7ffc96567e30 T262958)​
    #0 0x86b6e7 in duk__call_setup_act_not_tailcall /home/user/fuzz/duktape/duk_js_call.c:1570​
    #1 0x854cf5 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2006:3​
    #2 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #3 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20​
    #4 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8​
    #5 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #6 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #7 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #8 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #9 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #10 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #11 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #12 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #13 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #14 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #15 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #16 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #17 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #18 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #19 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #20 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #21 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #22 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #23 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #24 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #25 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #26 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #27 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #28 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #29 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #30 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #31 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #32 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #33 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #34 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #35 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #36 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #37 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #38 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #39 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #40 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #41 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #42 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #43 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #44 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #45 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #46 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #47 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #48 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #49 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #50 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #51 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #52 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #53 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #54 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #55 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #56 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #57 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #58 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #59 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #60 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #61 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #62 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #63 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #64 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #65 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #66 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #67 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #68 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #69 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #70 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #71 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #72 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #73 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #74 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #75 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #76 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #77 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #78 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #79 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #80 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #81 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #82 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #83 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #84 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #85 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #86 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #87 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #88 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #89 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #90 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #91 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #92 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #93 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #94 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #95 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #96 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #97 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #98 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #99 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #100 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #101 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #102 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #103 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #104 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #105 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #106 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #107 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #108 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #109 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #110 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #111 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #112 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #113 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #114 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #115 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #116 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #117 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #118 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #119 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #120 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #121 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #122 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #123 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #124 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #125 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #126 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #127 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #128 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #129 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #130 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #131 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #132 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #133 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #134 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #135 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #136 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #137 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #138 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #139 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #140 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #141 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #142 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #143 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #144 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #145 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #146 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #147 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #148 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #149 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #150 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #151 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #152 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #153 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #154 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #155 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #156 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #157 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #158 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #159 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #160 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #161 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #162 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #163 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #164 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #165 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #166 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #167 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #168 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #169 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #170 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #171 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #172 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #173 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #174 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #175 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #176 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #177 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #178 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #179 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #180 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #181 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #182 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #183 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #184 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #185 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #186 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #187 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #188 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #189 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #190 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #191 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #192 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #193 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #194 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #195 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #196 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #197 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #198 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #199 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #200 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #201 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #202 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #203 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #204 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #205 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #206 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #207 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #208 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #209 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #210 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #211 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #212 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #213 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #214 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #215 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #216 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #217 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #218 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #219 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #220 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #221 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #222 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #223 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #224 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #225 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #226 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #227 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #228 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #229 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #230 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #231 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #232 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #233 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #234 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #235 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #236 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #237 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #238 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #239 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #240 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #241 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #242 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #243 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #244 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #245 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #246 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #247 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #248 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #249 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #250 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #251 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #252 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #253 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #254 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
    #255 0x4aa49e in duk_prop_putvalue_inidx /home/user/fuzz/duktape/duk_prop_set.c:3222:7​
    #256 0x9d1d09 in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4420:4​
    #257 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4​
    #258 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3​
    #259 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9​
    #260 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2​
    #261 0xa84548 in duk__setcheck_found_setter_helper /home/user/fuzz/duktape/duk_prop_set.c:534:3​
    #262 0xa83b85 in duk__setcheck_found_setter_withkey /home/user/fuzz/duktape/duk_prop_set.c:565:9​
    #263 0xa825a4 in duk__setcheck_strkey_ordinary /home/user/fuzz/duktape/duk_prop_set.c:635:9​
    #264 0xa7491f in duk__setcheck_strkey_htypejump /home/user/fuzz/duktape/duk_prop_set.c:1915:9​
    #265 0xa96a6d in duk__prop_set_stroridx_helper /home/user/fuzz/duktape/duk_prop_set.c:2520:9​
    #266 0xa96a6d in duk__prop_set_strkey_unsafe /home/user/fuzz/duktape/duk_prop_set.c:2729:9​
    #267 0xa962bb in duk__prop_set_strkey /home/user/fuzz/duktape/duk_prop_set.c:2795:9​
    #268 0xa70a55 in duk__prop_putvalue_strkey_inidx /home/user/fuzz/duktape/duk_prop_set.c:3048:9​
​
SUMMARY: UndefinedBehaviorSanitizer: stack-overflow /home/user/fuzz/duktape/duk_js_call.c:1570 in duk__call_setup_act_not_tailcall​
==262958==ABORTING

Reproduce

./duk pocfile

POC File

function f0(a1, a2) {
    Object.defineProperty(a1, a2, { set: f0 });
    a1[a2] = f0;
    return a2;
}
f0(f0);
// CRASH INFO
// ==========
// TERMSIG: 11
// STDERR:
// 
// STDOUT:
// 
// ARGS: /home/user/fuzz/duktape/build/duk-fuzzilli --reprl
// EXECUTION TIME: 149ms

Credit

Gandalf4a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@gandalf4a