-
Notifications
You must be signed in to change notification settings - Fork 186
Multiple Assertion Errors #54
Copy link
Copy link
Closed
Description
We find some assertions errors against mjs with our developed fuzzing tool FOT (will open source in future).
The driver program is mostly copied from the README.md but it accepts an input file:
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include "mjs.h"
char* read_file_to_str(char* fname) {
char * buffer = 0;
long length;
FILE * f = fopen(fname, "rb");
if (f) {
fseek(f, 0, SEEK_END);
length = ftell (f);
fseek(f, 0, SEEK_SET);
buffer = malloc(length+1);
if (buffer) {
fread (buffer, 1, length, f);
}
fclose (f);
}
buffer[length] = 0;
return buffer;
}
void foo(int x) {
printf("Hello %d!\n", x);
}
void *my_dlsym(void *handle, const char *name) {
if (strcmp(name, "foo") == 0) return foo;
return NULL;
}
int main(int argc, char** argv) {
if (argc < 2) {
printf("usage: %s <js_file>\n", argv[0]);
exit(1);
}
char* content = read_file_to_str(argv[1]);
// printf("content:\t%s\n", content);
struct mjs *mjs = mjs_create();
mjs_set_ffi_resolver(mjs, my_dlsym);
mjs_err_t res = mjs_exec(mjs, content, NULL);
// printf("exec res is : %d\n", res);
mjs_destroy(mjs);
free(content);
return res;
}a.out: mjs.c:8399: mjs_val_t mjs_pop_val(struct mbuf *): Assertion `m->len >= sizeof(v)' failed.
[1] 10370 abort ../../a.out 8399.txt
a.out: mjs.c:9355: mjs_err_t mjs_execute(struct mjs *, size_t, mjs_val_t *): Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed.
[1] 25731 abort ../../a.out 9355.txt
a.out: mjs.c:11829: struct mjs_object *get_object_struct(mjs_val_t): Assertion `mjs_is_object(v)' failed.
[1] 30905 abort ../../a.out 11829.txt
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels