Skip to content

Multiple Assertion Errors #54

@hongxuchen

Description

@hongxuchen

We find some assertions errors against mjs with our developed fuzzing tool FOT (will open source in future).

The driver program is mostly copied from the README.md but it accepts an input file:

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include "mjs.h"

char* read_file_to_str(char* fname) {
    char * buffer = 0;
    long length;
    FILE * f = fopen(fname, "rb");
    if (f) {
        fseek(f, 0, SEEK_END);
        length = ftell (f);
        fseek(f, 0, SEEK_SET);
        buffer = malloc(length+1);
        if (buffer) {
            fread (buffer, 1, length, f);
        }
        fclose (f);
    }
    buffer[length] = 0;
    return buffer;
}

void foo(int x) {
    printf("Hello %d!\n", x);
}

void *my_dlsym(void *handle, const char *name) {
    if (strcmp(name, "foo") == 0) return foo;
    return NULL;
}

int main(int argc, char** argv) {
    if (argc < 2) {
      printf("usage: %s <js_file>\n", argv[0]);
      exit(1);
    }
    char* content = read_file_to_str(argv[1]);
    // printf("content:\t%s\n", content);
    struct mjs *mjs = mjs_create();
    mjs_set_ffi_resolver(mjs, my_dlsym);
    mjs_err_t res = mjs_exec(mjs, content, NULL);
    // printf("exec res is : %d\n", res);
    mjs_destroy(mjs);
    free(content);
    return res;
}

8399.txt

a.out: mjs.c:8399: mjs_val_t mjs_pop_val(struct mbuf *): Assertion `m->len >= sizeof(v)' failed.
[1] 10370 abort ../../a.out 8399.txt

9355.txt

a.out: mjs.c:9355: mjs_err_t mjs_execute(struct mjs *, size_t, mjs_val_t *): Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed.
[1] 25731 abort ../../a.out 9355.txt

11829.txt

a.out: mjs.c:11829: struct mjs_object *get_object_struct(mjs_val_t): Assertion `mjs_is_object(v)' failed.
[1] 30905 abort ../../a.out 11829.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions