Stack-overflow at jerryscript/jerry-core/parser/js/js-scanner-util.c:2036

[ericliuu]

Hello, I found a crash in the JerryScript parser.

JerryScript revision

355ab24

Build platform

Ubuntu 24.04.2

Build steps

python3 tools/build.py --clean --compile-flag=-fno-omit-frame-pointer --compile-flag=-fno-common --compile-flag=-fsanitize=address --compile-flag=-g --strip=off --lto=off --error-messages=on --logging=on --line-info=on --stack-limit=20

Test case

class C extends class {}
{
  constructor() {
    for (let in)

Output

=================================================================
==213477==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x767488900078 at pc 0x5c49d2b87887 bp 0x7ffe55a869e0 sp 0x7ffe55a869d0
READ of size 1 at 0x767488900078 thread T0
    #0 0x5c49d2b87886 in scanner_is_context_needed jerryscript/jerry-core/parser/js/js-scanner-util.c:2036
    #1 0x5c49d2be8b71 in parser_push_block_context jerryscript/jerry-core/parser/js/js-parser-statm.c:333
    #2 0x5c49d2becc08 in parser_parse_for_statement_start jerryscript/jerry-core/parser/js/js-parser-statm.c:1188
    #3 0x5c49d2becc08 in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2851
    #4 0x5c49d2b82077 in parser_parse_function jerryscript/jerry-core/parser/js/js-parser.c:2717
    #5 0x5c49d2be14f4 in parser_parse_class_body jerryscript/jerry-core/parser/js/js-parser-expr.c:588
    #6 0x5c49d2be14f4 in parser_parse_class jerryscript/jerry-core/parser/js/js-parser-expr.c:1137
    #7 0x5c49d2beb77d in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2787
    #8 0x5c49d2b815a7 in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:2280
    #9 0x5c49d2b228eb in jerry_parse_common jerryscript/jerry-core/api/jerryscript.c:413
    #10 0x5c49d2b22b19 in jerry_parse jerryscript/jerry-core/api/jerryscript.c:481
    #11 0x5c49d2bf5ff0 in jerryx_source_parse_script jerryscript/jerry-ext/util/sources.c:52
    #12 0x5c49d2bf6094 in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:63
    #13 0x5c49d2b1cd89 in main jerryscript/jerry-main/main-desktop.c:156
    #14 0x76748a62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x76748a62a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #16 0x5c49d2b1f4f4 in _start (jerryscript/build/bin/jerry+0x2a4f4) (BuildId: 17c3aadef0d80cfcfe75b8301417b3c3fd3fce2e)

Address 0x767488900078 is located in stack of thread T0 at offset 120 in frame
    #0 0x5c49d2b7feca in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:1987

  This frame has 5 object(s):
    [32, 33) 'flags' (line 2041)
    [48, 49) 'flags' (line 2063)
    [64, 80) 'branch' (line 2253)
    [96, 120) 'scanner_info_end' (line 2115) <== Memory access at offset 120 overflows this variable
    [160, 768) 'context' (line 1988)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow jerryscript/jerry-core/parser/js/js-scanner-util.c:2036 in scanner_is_context_needed
Shadow bytes around the buggy address:
  0x7674888ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7674888ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7674888ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7674888fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7674888fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x767488900000: f1 f1 f1 f1 01 f2 01 f2 00 00 f2 f2 00 00 00[f2]
  0x767488900080: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
  0x767488900100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x767488900180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x767488900200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x767488900280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==213477==ABORTING

If I build with the debug flag in addition to the above build command, the test case produces an assertion failure instead:

ICE: Assertion '!has_context || context_p->next_scanner_info_p->type == SCANNER_TYPE_BLOCK' failed at /home/eric/Repos/llm-compiler-fuzz/pie/engines/jerry/jerryscript/jerry-core/parser/js/js-parser-statm.c(parser_parse_for_statement_start):1161.
Error: JERRY_FATAL_FAILED_ASSERTION
Aborted

Expected behavior

Running this test case through a different JS engine (JavaScriptCore) results in a lexing error at the keyword in as it expects a variable before in. Perhaps a similar check for JerryScript can gracefully handle this malformed code?