1492069 - AddressSanitizer: heap-buffer-overflow [@ js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::checkPositionalParameterIndices] with READ of size 8

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision f9d0225d85d2 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --enable-tests --enable-fuzzing --disable-debug --enable-address-sanitizer --disable-jemalloc --enable-optimize=-O2, run with FUZZER=BinAST ./fuzz-tests test.binjs).

Backtrace:

==24561==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000029df8 at pc 0x561656f08c58 bp 0x7ffc225a13b0 sp 0x7ffc225a13a8
READ of size 8 at 0x602000029df8 thread T0
    #0 0x561656f08c57 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::checkPositionalParameterIndices(JS::Handle<JS::GCVector<JSAtom*, 0ul, js::TempAllocPolicy> >, js::frontend::ListNode*) js/src/frontend/BinSource.cpp:366:28
    #1 0x561656da1d65 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceFunctionExpressionContents(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&, unsigned int, js::frontend::ListNode**, js::frontend::ListNode**) js/src/frontend/BinSource-auto.cpp:5549:5
    #2 0x561656da0a09 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseFunctionExpressionContents(unsigned int, js::frontend::ListNode**, js::frontend::ListNode**) js/src/frontend/BinSource-auto.cpp:5510:5
    #3 0x561656d4f2d3 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceEagerFunctionExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:4702:5
    #4 0x561656d1c852 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:612:9
    #5 0x561656d1b691 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseExpression() js/src/frontend/BinSource-auto.cpp:567:5
    #6 0x561656d73dce in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceDataProperty(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:4362:5
    #7 0x561656d33f2f in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumObjectProperty(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:1790:9
    #8 0x561656d33a21 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseObjectProperty() js/src/frontend/BinSource-auto.cpp:1778:5
    #9 0x561656dd5dd3 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseListOfObjectProperty() js/src/frontend/BinSource-auto.cpp:8334:9
    #10 0x561656d56859 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceObjectExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:6656:5
    #11 0x561656d3a41e in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumSpreadElementOrExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:2149:9
    #12 0x561656d39211 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSpreadElementOrExpression() js/src/frontend/BinSource-auto.cpp:2065:5
    #13 0x561656dcadc3 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseArguments() js/src/frontend/BinSource-auto.cpp:8153:9
    #14 0x561656d4b76f in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceCallExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:3850:5
    #15 0x561656d1d022 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:591:9
    #16 0x561656dd2039 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseOptionalExpression() js/src/frontend/BinSource-auto.cpp:8566:9
    #17 0x561656dbfe48 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceVariableDeclarator(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:7717:5
    #18 0x561656dbf771 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseVariableDeclarator() js/src/frontend/BinSource-auto.cpp:7698:5
    #19 0x561656dd99d2 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseListOfVariableDeclarator() js/src/frontend/BinSource-auto.cpp:8439:9
    #20 0x561656d5df0f in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceVariableDeclaration(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:7656:5
    #21 0x561656d3ca87 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumStatement(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:2292:9
    #22 0x561656d3c411 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseStatement() js/src/frontend/BinSource-auto.cpp:2217:5
    #23 0x561656dc9102 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseListOfStatement() js/src/frontend/BinSource-auto.cpp:8400:9
    #24 0x561656d75746 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceScript(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:6750:5
    #25 0x561656d3675c in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumProgram(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:1897:9
    #26 0x561656d36141 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseProgram() js/src/frontend/BinSource-auto.cpp:1882:5
    #27 0x561656effab9 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseAux(js::frontend::GlobalSharedContext*, unsigned char const*, unsigned long) js/src/frontend/BinSource.cpp:145:5
    #28 0x561656f00357 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parse(js::frontend::GlobalSharedContext*, unsigned char const*, unsigned long) js/src/frontend/BinSource.cpp:118:19
    #29 0x561656f00357 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parse(js::frontend::GlobalSharedContext*, mozilla::Vector<unsigned char, 0ul, js::TempAllocPolicy> const&) js/src/frontend/BinSource.cpp:112
    #30 0x561656b929ce in testBinASTReaderFuzz(unsigned char const*, unsigned long) js/src/fuzz-tests/testBinASTReader.cpp:67:29
[...]
    #38 0x561656a91ba8 in _start (build/fuzz-tests+0x20e6ba8)

0x602000029df8 is located 0 bytes to the right of 8-byte region [0x602000029df0,0x602000029df8)
allocated by thread T0 here:
    #0 0x561656b55e18 in __interceptor_malloc (/home/ubuntu/build/build/fuzz-tests+0x21aae18)
    #1 0x561656eeb9aa in js_arena_malloc(unsigned long, unsigned long) dist/include/js/Utility.h:390:12
    #2 0x561656eeb9aa in JSAtom** js_pod_arena_malloc<JSAtom*>(unsigned long, unsigned long) dist/include/js/Utility.h:588
    #3 0x561656eeb9aa in JSAtom** js_pod_malloc<JSAtom*>(unsigned long) dist/include/js/Utility.h:595
    #4 0x561656eeb9aa in JSAtom** js::AllocPolicyBase::maybe_pod_malloc<JSAtom*>(unsigned long) dist/include/js/AllocPolicy.h:34
    #5 0x561656eeee62 in JSAtom** js::TempAllocPolicy::pod_malloc<JSAtom*>(unsigned long) dist/include/js/AllocPolicy.h:93:22
    #6 0x561656eeeb61 in mozilla::Vector<JSAtom*, 0ul, js::TempAllocPolicy>::convertToHeapStorage(unsigned long) dist/include/mozilla/Vector.h:959:30
    #7 0x561656eeea5a in mozilla::Vector<JSAtom*, 0ul, js::TempAllocPolicy>::growStorageBy(unsigned long) dist/include/mozilla/Vector.h:1050:12
    #8 0x561656eeded3 in mozilla::Vector<JSAtom*, 0ul, js::TempAllocPolicy>::growBy(unsigned long) dist/include/mozilla/Vector.h:1152:9
    #9 0x561656eeded3 in mozilla::Vector<JSAtom*, 0ul, js::TempAllocPolicy>::resize(unsigned long) dist/include/mozilla/Vector.h:1205
    #10 0x561656dc5811 in JS::GCVector<JSAtom*, 0ul, js::TempAllocPolicy>::resize(unsigned long) dist/include/js/GCVector.h:74:61
    #11 0x561656dc5811 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseListOfAssertedMaybePositionalParameterName(js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::AssertedScopeKind, JS::MutableHandle<JS::GCVector<JSAtom*, 0ul, js::TempAllocPolicy> >) js/src/frontend/BinSource-auto.cpp:8236
    #12 0x561656d811cc in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceAssertedParameterScope(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&, JS::MutableHandle<JS::GCVector<JSAtom*, 0ul, js::TempAllocPolicy> >) js/src/frontend/BinSource-auto.cpp:2976:5
    #13 0x561656d80b9b in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseAssertedParameterScope(JS::MutableHandle<JS::GCVector<JSAtom*, 0ul, js::TempAllocPolicy> >) js/src/frontend/BinSource-auto.cpp:2956:5
    #14 0x561656da1959 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceFunctionExpressionContents(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&, unsigned int, js::frontend::ListNode**, js::frontend::ListNode**) js/src/frontend/BinSource-auto.cpp:5544:5
    #15 0x561656da0a09 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseFunctionExpressionContents(unsigned int, js::frontend::ListNode**, js::frontend::ListNode**) js/src/frontend/BinSource-auto.cpp:5510:5
    #16 0x561656d4f2d3 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceEagerFunctionExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:4702:5
    #17 0x561656d1c852 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:612:9
    #18 0x561656d1b691 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseExpression() js/src/frontend/BinSource-auto.cpp:567:5
    #19 0x561656d73dce in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceDataProperty(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:4362:5
    #20 0x561656d33f2f in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumObjectProperty(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:1790:9
    #21 0x561656d33a21 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseObjectProperty() js/src/frontend/BinSource-auto.cpp:1778:5
    #22 0x561656dd5dd3 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseListOfObjectProperty() js/src/frontend/BinSource-auto.cpp:8334:9
    #23 0x561656d56859 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceObjectExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:6656:5
    #24 0x561656d3a41e in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumSpreadElementOrExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:2149:9
    #25 0x561656d39211 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSpreadElementOrExpression() js/src/frontend/BinSource-auto.cpp:2065:5
    #26 0x561656dcadc3 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseArguments() js/src/frontend/BinSource-auto.cpp:8153:9
    #27 0x561656d4b76f in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceCallExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:3850:5
    #28 0x561656d1d022 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumExpression(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:591:9
    #29 0x561656dd2039 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseOptionalExpression() js/src/frontend/BinSource-auto.cpp:8566:9
    #30 0x561656dbfe48 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceVariableDeclarator(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:7717:5
    #31 0x561656dbf771 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseVariableDeclarator() js/src/frontend/BinSource-auto.cpp:7698:5
    #32 0x561656dd99d2 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseListOfVariableDeclarator() js/src/frontend/BinSource-auto.cpp:8439:9
    #33 0x561656d5df0f in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseInterfaceVariableDeclaration(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:7656:5
    #34 0x561656d3ca87 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::parseSumStatement(unsigned long, js::frontend::BinKind, js::frontend::BinTokenReaderMultipart::BinFields const&) js/src/frontend/BinSource-auto.cpp:2292:9

SUMMARY: AddressSanitizer: heap-buffer-overflow js/src/frontend/BinSource.cpp:366:28 in js::frontend::BinASTParser<js::frontend::BinTokenReaderMultipart>::checkPositionalParameterIndices(JS::Handle<JS::GCVector<JSAtom*, 0ul, js::TempAllocPolicy> >, js::frontend::ListNode*)
Shadow bytes around the buggy address:
  0x0c047fffd390: fa fa fd fa fa fa fd fa fa fa fa fa fa fa fa fa
  0x0c047fffd3a0: fa fa fa fa fa fa fd fa fa fa fa fa fa fa 04 fa
=>0x0c047fffd3b0: fa fa 04 fa fa fa 04 fa fa fa fd fa fa fa 00[fa]
  0x0c047fffd3c0: fa fa fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd3d0: fa fa 04 fa fa fa 04 fa fa fa fd fa fa fa 04 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
==24561==ABORTING

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Christian Holler (:decoder)]

This actually started to happen once I added new test samples into the fuzzing, and now it is blocking fuzzing because it is happening really frequently and also disturbing the coverage measurements. Marking as fuzzblocker.

Comment 3

[Tooru Fujisawa [:arai]]

Attachment: Do not check rest parameter while checking positional parameter.

checkPositionalParameterIndices should have ignored rest parameter.

Comment 4

[David Teller [:Yoric] - still alive but not very active]

Comment on attachment 9010138 [details] [diff] [review]
Do not check rest parameter while checking positional parameter.

Review of attachment 9010138 [details] [diff] [review]:
-----------------------------------------------------------------

lgtm!

Comment 5

[Tooru Fujisawa [:arai]]

This is recent change and nightly-only, and also disabled by default, I'll land without sec-approval.

Comment 6

[Tooru Fujisawa [:arai]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/758f4ad8502e8be4d7d72704eef9bea211108726
Bug 1492069 - Do not check rest parameter while checking positional parameter. r=Yoric

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/758f4ad8502e