Skip to content

JS_DumpMemoryUsage will crash if u use promise #1046

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 13, 2025

Conversation

sallmann
Copy link
Contributor

@sallmann sallmann commented May 2, 2025

@bnoordhuis
Copy link
Contributor

LGTM but can you add a regression test to api-test.c? Did you author this line of code or is it Fabrice's?

@sallmann
Copy link
Contributor Author

sallmann commented May 2, 2025

The work is actually from Fabrice.

I corrected the code according his actual commit and added the regression test.

Without the change it would output with activated AddressSanitizer:

add_compile_options(-fsanitize=address)
add_link_options(-fsanitize=address)
dev@dev /home/dev/projects/github/quickjs/build $ ./api-test
=================================================================
==19945==ERROR: AddressSanitizer: global-buffer-overflow on address 0x6413034c2a00 at pc 0x641303240556 bp 0x7ffe2c113100 sp 0x7ffe2c1130f0
READ of size 4 at 0x6413034c2a00 thread T0
    #0 0x641303240555 in JS_DumpMemoryUsage (/home/dev/projects/github/quickjs/build/api-test+0x3e555) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19)
    #1 0x64130322a5dd in main (/home/dev/projects/github/quickjs/build/api-test+0x285dd) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19)
    #2 0x7d4fe6835487  (/usr/lib/libc.so.6+0x27487) (BuildId: d056ce83eebe65ce7e52ecfa5af5363e4863d283)
    #3 0x7d4fe683554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: d056ce83eebe65ce7e52ecfa5af5363e4863d283)
    #4 0x64130322a8c4 in _start (/home/dev/projects/github/quickjs/build/api-test+0x288c4) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19)

0x6413034c2a00 is located 32 bytes before global variable 'js_module_ns_exotic_methods' defined in '/home/dev/projects/github/quickjs/quickjs.c:28329:35' (0x6413034c2a20) of size 56
0x6413034c2a00 is located 24 bytes after global variable 'js_std_class_def' defined in '/home/dev/projects/github/quickjs/quickjs.c:1691:30' (0x6413034c2580) of size 1128
SUMMARY: AddressSanitizer: global-buffer-overflow (/home/dev/projects/github/quickjs/build/api-test+0x3e555) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19) in JS_DumpMemoryUsage
Shadow bytes around the buggy address:
  0x6413034c2780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
=>0x6413034c2a00:[f9]f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
  0x6413034c2a80: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
  0x6413034c2b00: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9
  0x6413034c2b80: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
  0x6413034c2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==19945==ABORTING

@saghul saghul merged commit 7e8abe1 into quickjs-ng:master May 13, 2025
127 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

JS_DumpMemoryUsage will crash if u use promise
3 participants