Skip to content

Conversation

sallmann
Copy link
Contributor

@sallmann sallmann commented May 2, 2025

@bnoordhuis
Copy link
Contributor

LGTM but can you add a regression test to api-test.c? Did you author this line of code or is it Fabrice's?

@sallmann
Copy link
Contributor Author

sallmann commented May 2, 2025

The work is actually from Fabrice.

I corrected the code according his actual commit and added the regression test.

Without the change it would output with activated AddressSanitizer:

add_compile_options(-fsanitize=address) add_link_options(-fsanitize=address) 
dev@dev /home/dev/projects/github/quickjs/build $ ./api-test ================================================================= ==19945==ERROR: AddressSanitizer: global-buffer-overflow on address 0x6413034c2a00 at pc 0x641303240556 bp 0x7ffe2c113100 sp 0x7ffe2c1130f0 READ of size 4 at 0x6413034c2a00 thread T0 #0 0x641303240555 in JS_DumpMemoryUsage (/home/dev/projects/github/quickjs/build/api-test+0x3e555) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19) #1 0x64130322a5dd in main (/home/dev/projects/github/quickjs/build/api-test+0x285dd) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19) #2 0x7d4fe6835487 (/usr/lib/libc.so.6+0x27487) (BuildId: d056ce83eebe65ce7e52ecfa5af5363e4863d283) #3 0x7d4fe683554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: d056ce83eebe65ce7e52ecfa5af5363e4863d283) #4 0x64130322a8c4 in _start (/home/dev/projects/github/quickjs/build/api-test+0x288c4) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19) 0x6413034c2a00 is located 32 bytes before global variable 'js_module_ns_exotic_methods' defined in '/home/dev/projects/github/quickjs/quickjs.c:28329:35' (0x6413034c2a20) of size 56 0x6413034c2a00 is located 24 bytes after global variable 'js_std_class_def' defined in '/home/dev/projects/github/quickjs/quickjs.c:1691:30' (0x6413034c2580) of size 1128 SUMMARY: AddressSanitizer: global-buffer-overflow (/home/dev/projects/github/quickjs/build/api-test+0x3e555) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19) in JS_DumpMemoryUsage Shadow bytes around the buggy address: 0x6413034c2780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6413034c2800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6413034c2880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6413034c2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6413034c2980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 =>0x6413034c2a00:[f9]f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 0x6413034c2a80: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 0x6413034c2b00: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9 0x6413034c2b80: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 0x6413034c2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6413034c2c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==19945==ABORTING 
@saghul saghul merged commit 7e8abe1 into quickjs-ng:master May 13, 2025
127 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants