{"action":"created","issue":{"url":"https://api.github.com/repos/jerryscript-project/jerryscript/issues/2386","repository_url":"https://api.github.com/repos/jerryscript-project/jerryscript","labels_url":"https://api.github.com/repos/jerryscript-project/jerryscript/issues/2386/labels{/name}","comments_url":"https://api.github.com/repos/jerryscript-project/jerryscript/issues/2386/comments","events_url":"https://api.github.com/repos/jerryscript-project/jerryscript/issues/2386/events","html_url":"https://github.com/jerryscript-project/jerryscript/issues/2386","id":329769656,"node_id":"MDU6SXNzdWUzMjk3Njk2NTY=","number":2386,"title":"heap-use-after-free in ecma_lcache_lookup","user":{"login":"renatahodovan","id":3356404,"node_id":"MDQ6VXNlcjMzNTY0MDQ=","avatar_url":"https://avatars2.githubusercontent.com/u/3356404?v=4","gravatar_id":"","url":"https://api.github.com/users/renatahodovan","html_url":"https://github.com/renatahodovan","followers_url":"https://api.github.com/users/renatahodovan/followers","following_url":"https://api.github.com/users/renatahodovan/following{/other_user}","gists_url":"https://api.github.com/users/renatahodovan/gists{/gist_id}","starred_url":"https://api.github.com/users/renatahodovan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/renatahodovan/subscriptions","organizations_url":"https://api.github.com/users/renatahodovan/orgs","repos_url":"https://api.github.com/users/renatahodovan/repos","events_url":"https://api.github.com/users/renatahodovan/events{/privacy}","received_events_url":"https://api.github.com/users/renatahodovan/received_events","type":"User","site_admin":false},"labels":[{"id":195265504,"node_id":"MDU6TGFiZWwxOTUyNjU1MDQ=","url":"https://api.github.com/repos/jerryscript-project/jerryscript/labels/bug","name":"bug","color":"f7c6c7","default":true},{"id":211036963,"node_id":"MDU6TGFiZWwyMTEwMzY5NjM=","url":"https://api.github.com/repos/jerryscript-project/jerryscript/labels/critical","name":"critical","color":"fc2929","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-06-06T08:42:00Z","updated_at":"2018-06-08T13:53:30Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"###### Jerry version:\r\n\r\n```\r\nChecked revision: 8b8bced6\r\nBuild command: CC=clang ./tools/build.py --clean --debug --compile-flag=-fsanitize=address \\\r\n        --compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \\\r\n        --compile-flag=-fno-common --compile-flag=-g --jerry-libc=off \\\r\n        --strip=off --system-allocator=on \\\r\n        --linker-flag=-fuse-ld=gold --error-messages=on --lto=off\r\n(Can be reproduced with GCC, too.)\r\n```\r\n###### OS:\r\n\r\n```\r\nUbuntu 17.10\r\n```\r\n###### Test case:\r\n\r\n```javascript\r\nMath in Number\r\n```\r\n\r\n###### Backtrace:\r\n\r\n```\r\n=================================================================\r\n==25129==ERROR: AddressSanitizer: heap-use-after-free on address 0xf60008b2 at pc 0x081b7812 bp 0xff8e17b8 sp 0xff8e17ac\r\nREAD of size 2 at 0xf60008b2 thread T0\r\n    #0 0x81b7811 in ecma_lcache_lookup jerryscript/jerry-core/ecma/base/ecma-lcache.c:180:30\r\n    #1 0x81af4f9 in ecma_find_named_property jerryscript/jerry-core/ecma/base/ecma-helpers.c:614:33\r\n    #2 0x81de2cd in ecma_op_object_get_own_property jerryscript/jerry-core/ecma/operations/ecma-objects.c:190:33\r\n    #3 0x81dea55 in ecma_op_object_get_property jerryscript/jerry-core/ecma/operations/ecma-objects.c:328:32\r\n    #4 0x81deb78 in ecma_op_object_has_property jerryscript/jerry-core/ecma/operations/ecma-objects.c:378:30\r\n    #5 0x82983f7 in opfunc_in jerryscript/jerry-core/vm/opcodes-ecma-relational-equality.c:144:35\r\n    #6 0x8217a18 in vm_loop jerryscript/jerry-core/vm/vm.c:2261:20\r\n    #7 0x820b442 in vm_execute jerryscript/jerry-core/vm/vm.c:2988:24\r\n    #8 0x820aaf8 in vm_run jerryscript/jerry-core/vm/vm.c:3081:10\r\n    #9 0x8209fee in vm_run_global jerryscript/jerry-core/vm/vm.c:225:28\r\n    #10 0x8171d56 in jerry_run jerryscript/jerry-core/api/jerry.c:550:24\r\n    #11 0x816c5f7 in main jerryscript/jerry-main/main-unix.c:660:21\r\n    #12 0xf7bc0985 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18985)\r\n    #13 0x806e5a7 in _start (jerryscript/build_asan/bin/jerry+0x806e5a7)\r\n\r\n0xf60008b2 is located 2 bytes inside of 21-byte region [0xf60008b0,0xf60008c5)\r\nfreed by thread T0 here:\r\n    #0 0x8131a0c in __interceptor_free.localalias.0 (jerryscript/build_asan/bin/jerry+0x8131a0c)\r\n    #1 0x81e5c4c in jmem_heap_free_block jerryscript/jerry-core/jmem/jmem-heap.c:503:3\r\n    #2 0x821fd53 in ecma_dealloc_string_buffer jerryscript/jerry-core/ecma/base/ecma-alloc.c:184:3\r\n    #3 0x819f590 in ecma_deref_ecma_string jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:923:7\r\n    #4 0x81ac04c in ecma_free_value jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:915:7\r\n    #5 0x82983e5 in opfunc_in jerryscript/jerry-core/vm/opcodes-ecma-relational-equality.c:142:3\r\n    #6 0x8217a18 in vm_loop jerryscript/jerry-core/vm/vm.c:2261:20\r\n    #7 0x820b442 in vm_execute jerryscript/jerry-core/vm/vm.c:2988:24\r\n    #8 0x820aaf8 in vm_run jerryscript/jerry-core/vm/vm.c:3081:10\r\n    #9 0x8209fee in vm_run_global jerryscript/jerry-core/vm/vm.c:225:28\r\n    #10 0x8171d56 in jerry_run jerryscript/jerry-core/api/jerry.c:550:24\r\n    #11 0x816c5f7 in main jerryscript/jerry-main/main-unix.c:660:21\r\n    #12 0xf7bc0985 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18985)\r\n\r\npreviously allocated by thread T0 here:\r\n    #0 0x8131bc4 in malloc (jerryscript/build_asan/bin/jerry+0x8131bc4)\r\n    #1 0x81e5c96 in jmem_heap_alloc_block_internal jerryscript/jerry-core/jmem/jmem-heap.c:295:10\r\n    #2 0x81e5ad7 in jmem_heap_gc_and_alloc_block jerryscript/jerry-core/jmem/jmem-heap.c:329:24\r\n    #3 0x81e59b3 in jmem_heap_alloc_block jerryscript/jerry-core/jmem/jmem-heap.c:375:10\r\n    #4 0x821fd26 in ecma_alloc_string_buffer jerryscript/jerry-core/ecma/base/ecma-alloc.c:170:10\r\n    #5 0x819b9d0 in ecma_new_ecma_string_from_utf8 jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:224:21\r\n    #6 0x81bd206 in ecma_builtin_helper_object_to_string jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.c:107:18\r\n    #7 0x8248ae6 in ecma_builtin_object_prototype_object_to_string jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object-prototype.c:59:10\r\n    #8 0x82488cf in ecma_builtin_object_prototype_dispatch_routine jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object-prototype.inc.h:32:1\r\n    #9 0x81cca3f in ecma_builtin_dispatch_routine jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:890:10\r\n    #10 0x81cc7ca in ecma_builtin_dispatch_call jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:915:17\r\n    #11 0x81d5214 in ecma_op_function_call jerryscript/jerry-core/ecma/operations/ecma-function-object.c:439:19\r\n    #12 0x81dad38 in ecma_op_general_object_default_value jerryscript/jerry-core/ecma/operations/ecma-objects-general.c:239:25\r\n    #13 0x81e11e0 in ecma_op_object_default_value jerryscript/jerry-core/ecma/operations/ecma-objects.c:1089:10\r\n    #14 0x81cf724 in ecma_op_to_primitive jerryscript/jerry-core/ecma/operations/ecma-conversion.c:177:12\r\n    #15 0x81d034b in ecma_op_to_string jerryscript/jerry-core/ecma/operations/ecma-conversion.c:380:5\r\n    #16 0x8298395 in opfunc_in jerryscript/jerry-core/vm/opcodes-ecma-relational-equality.c:133:36\r\n    #17 0x8217a18 in vm_loop jerryscript/jerry-core/vm/vm.c:2261:20\r\n    #18 0x820b442 in vm_execute jerryscript/jerry-core/vm/vm.c:2988:24\r\n    #19 0x820aaf8 in vm_run jerryscript/jerry-core/vm/vm.c:3081:10\r\n    #20 0x8209fee in vm_run_global jerryscript/jerry-core/vm/vm.c:225:28\r\n    #21 0x8171d56 in jerry_run jerryscript/jerry-core/api/jerry.c:550:24\r\n    #22 0x816c5f7 in main jerryscript/jerry-main/main-unix.c:660:21\r\n    #23 0xf7bc0985 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18985)\r\n\r\nSUMMARY: AddressSanitizer: heap-use-after-free jerryscript/jerry-core/ecma/base/ecma-lcache.c:180:30 in ecma_lcache_lookup\r\nShadow bytes around the buggy address:\r\n  0x3ec000c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x3ec000d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x3ec000e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x3ec000f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x3ec00100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n=>0x3ec00110: fa fa fa fa fa fa[fd]fd fd fa fa fa 00 00 00 fa\r\n  0x3ec00120: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00\r\n  0x3ec00130: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa\r\n  0x3ec00140: 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00 00 fa\r\n  0x3ec00150: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00\r\n  0x3ec00160: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==25129==ABORTING\r\n\r\n```\r\n\r\n<sup>Found by [Fuzzinator](http://fuzzinator.readthedocs.io/) with [grammarinator](https://github.com/renatahodovan/grammarinator). </sup>\r\n"},"comment":{"url":"https://api.github.com/repos/jerryscript-project/jerryscript/issues/comments/395767646","html_url":"https://github.com/jerryscript-project/jerryscript/issues/2386#issuecomment-395767646","issue_url":"https://api.github.com/repos/jerryscript-project/jerryscript/issues/2386","id":395767646,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NTc2NzY0Ng==","user":{"login":"zherczeg","id":2270193,"node_id":"MDQ6VXNlcjIyNzAxOTM=","avatar_url":"https://avatars2.githubusercontent.com/u/2270193?v=4","gravatar_id":"","url":"https://api.github.com/users/zherczeg","html_url":"https://github.com/zherczeg","followers_url":"https://api.github.com/users/zherczeg/followers","following_url":"https://api.github.com/users/zherczeg/following{/other_user}","gists_url":"https://api.github.com/users/zherczeg/gists{/gist_id}","starred_url":"https://api.github.com/users/zherczeg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zherczeg/subscriptions","organizations_url":"https://api.github.com/users/zherczeg/orgs","repos_url":"https://api.github.com/users/zherczeg/repos","events_url":"https://api.github.com/users/zherczeg/events{/privacy}","received_events_url":"https://api.github.com/users/zherczeg/received_events","type":"User","site_admin":false},"created_at":"2018-06-08T13:53:30Z","updated_at":"2018-06-08T13:53:30Z","author_association":"CONTRIBUTOR","body":"Could we improve the quality of these reposrt? The `Shadow bytes around the buggy address:` is totally useless. I would also like to see the arguments for the functions not just their names."}}
{"actor":{"display_login":"zherczeg"}}