Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

stack-overflow in duktape/duk_js_call.c:1361 in duk__call_setup_act_attempt_tailcall #2548

Open
gandalf4a opened this issue Oct 10, 2023 · 0 comments
Open

stack-overflow in duktape/duk_js_call.c:1361 in duk__call_setup_act_attempt_tailcall #2548

gandalf4a opened this issue Oct 10, 2023 · 0 comments

Comments

@gandalf4a
Copy link

Version

$ git show
commit 47eedc5d53cdab72c5933148496b91142d5f0940 (HEAD -> master, origin/master, origin/HEAD)
Merge: f203a13e 7f66f09f
Author: Sami Vaarala <[email protected]>
Date:   Sun Sep 10 16:07:39 2023 +0300

Platform

$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Asan

duk_hobject_lookup.c:20:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_lookup.c:20:49 in 
duk_hobject_misc.c:124:70: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:124:70 in 
duk_hobject_misc.c:103:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:103:49 in 
duk_hobject_misc.c:104:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:104:49 in 
duk_hobject_resize.c:400:48: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:400:48 in 
duk_hobject_resize.c:401:46: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_resize.c:401:46 in 
duk_hobject_misc.c:266:50: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:266:50 in 
duk_hobject_misc.c:267:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_misc.c:267:49 in 
duk_heap_markandsweep.c:98:15: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_heap_markandsweep.c:98:15 in 
duk_util_bufwriter.c:27:16: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_util_bufwriter.c:27:16 in 
duk_util_bufwriter.c:29:22: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_util_bufwriter.c:29:22 in 
duk_hobject_lookup.c:105:49: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior duk_hobject_lookup.c:105:49 in 
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==4191020==ERROR: UndefinedBehaviorSanitizer: stack-overflow on address 0x7ffd3b8a7de8 (pc 0x000000864a4d bp 0x7ffd3b8a8490 sp 0x7ffd3b8a7df0 T4191020)
    #0 0x864a4d in duk__call_setup_act_attempt_tailcall /home/user/fuzz/duktape/duk_js_call.c:1361
    #1 0x854c5c in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:1986:18
    #2 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #3 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #4 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #5 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #6 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #7 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #8 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #9 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #10 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #11 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #12 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #13 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #14 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #15 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #16 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #17 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #18 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #19 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #20 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #21 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #22 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #23 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #24 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #25 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #26 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #27 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #28 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #29 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #30 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #31 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #32 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #33 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #34 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #35 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #36 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #37 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #38 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #39 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #40 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #41 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #42 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #43 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #44 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #45 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #46 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #47 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #48 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #49 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #50 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #51 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #52 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #53 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #54 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #55 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #56 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #57 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #58 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #59 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #60 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #61 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #62 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #63 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #64 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #65 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #66 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #67 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #68 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #69 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #70 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #71 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #72 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #73 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #74 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #75 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #76 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #77 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #78 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #79 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #80 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #81 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #82 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #83 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #84 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #85 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #86 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #87 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #88 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #89 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #90 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #91 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #92 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #93 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #94 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #95 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #96 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #97 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #98 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #99 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #100 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #101 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #102 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #103 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #104 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #105 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #106 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #107 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #108 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #109 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #110 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #111 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #112 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #113 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #114 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #115 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #116 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #117 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #118 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #119 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #120 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #121 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #122 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #123 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #124 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #125 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #126 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #127 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #128 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #129 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #130 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #131 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #132 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #133 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #134 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #135 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #136 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #137 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #138 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #139 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #140 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #141 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #142 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #143 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #144 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #145 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #146 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #147 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #148 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #149 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #150 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #151 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #152 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #153 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #154 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #155 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #156 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #157 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #158 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #159 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #160 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #161 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #162 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #163 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #164 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #165 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #166 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #167 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #168 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #169 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #170 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #171 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #172 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #173 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #174 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #175 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #176 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #177 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #178 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #179 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #180 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #181 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #182 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #183 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #184 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #185 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #186 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #187 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #188 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #189 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #190 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #191 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #192 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #193 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #194 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #195 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #196 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #197 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #198 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #199 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #200 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #201 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #202 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #203 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #204 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #205 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #206 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #207 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #208 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #209 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #210 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #211 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #212 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #213 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #214 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #215 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #216 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #217 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #218 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #219 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #220 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #221 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #222 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #223 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #224 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #225 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #226 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #227 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #228 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #229 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #230 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #231 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #232 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #233 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #234 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #235 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #236 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #237 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #238 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #239 0x4422cd in duk_call_method /home/user/fuzz/duktape/duk_api_call.c:152:2
    #240 0x712ff3 in duk__json_enc_value /home/user/fuzz/duktape/duk_bi_json.c:2130:3
    #241 0x466821 in duk_bi_json_stringify_helper /home/user/fuzz/duktape/duk_bi_json.c:3269:6
    #242 0x7c71cb in duk_bi_json_object_stringify /home/user/fuzz/duktape/duk_bi_json.c:3320:2
    #243 0x857ee3 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2143:9
    #244 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9
    #245 0xa11aaf in duk__executor_handle_call /home/user/fuzz/duktape/duk_js_executor.c:2721:20
    #246 0x9e9f3b in duk__js_execute_bytecode_inner /home/user/fuzz/duktape/duk_js_executor.c:4923:8
    #247 0x873d70 in duk_js_execute_bytecode /home/user/fuzz/duktape/duk_js_executor.c:3009:4
    #248 0x8576e4 in duk__handle_call_raw /home/user/fuzz/duktape/duk_js_call.c:2121:3
    #249 0x441ec2 in duk_handle_call_unprotected /home/user/fuzz/duktape/duk_js_call.c:2293:9

SUMMARY: UndefinedBehaviorSanitizer: stack-overflow /home/user/fuzz/duktape/duk_js_call.c:1361 in duk__call_setup_act_attempt_tailcall
==4191020==ABORTING

Reproduce

./duk pocfile

POC File

function f0(a1, a2, a3) {
    return JSON["stringify"](f0, f0);
}
f0(f0, f0, f0);
// CRASH INFO
// ==========
// TERMSIG: 11
// STDERR:
// 
// STDOUT:
// 
// ARGS: /home/user/fuzz/duktape/build/duk-fuzzilli --reprl
// EXECUTION TIME: 145ms

Credit

Gandalf4a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@gandalf4a