-
-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Closed
Description
During fuzzing test I receive this result, At the exploitation time I saw unusual eaten RAM usage, even with my 32 gb cloud machine downs in a few second. Normally during fuzzing it creates an instance of trigger but this time only shows me this result. I will be happy to understand background of the issue. And I also have another bug it causes timeout, for this I have reproducer too. but can not add this page because of its character encoding.
Unusual fuzzing result:
<--- Last few GCs --->
[12992:0x6b7b8f0] 7736 ms: Mark-Compact 3544.3 (4144.0) -> 3544.1 (4143.8) MB, 91.00 / 0.00 ms (average mu = 0.139, current mu = 0.010) allocation failure; GC in old space requested
[12992:0x6b7b8f0] 7826 ms: Mark-Compact 3544.4 (4144.1) -> 3544.3 (4144.0) MB, 88.78 / 0.00 ms (average mu = 0.080, current mu = 0.011) allocation failure; GC in old space requested
<--- JS stacktrace --->
FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
1: 0xc9adf0 node::Abort() [node]
2: 0xb700f7 [node]
3: 0xec0530 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
4: 0xec0817 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
5: 0x10d1ea5 [node]
6: 0x10d2434 v8::internal::Heap::RecomputeLimits(v8::internal::GarbageCollector) [node]
7: 0x10e9324 v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::internal::GarbageCollectionReason, char const*) [node]
8: 0x10e9b3c v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [node]
9: 0x10bfe41 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
10: 0x10c0fd5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
11: 0x109d616 v8::internal::Factory::AllocateRaw(int, v8::internal::AllocationType, v8::internal::AllocationAlignment) [node]
12: 0x108f114 v8::internal::FactoryBase<v8::internal::Factory>::AllocateRawWithImmortalMap(int, v8::internal::AllocationType, v8::internal::Map, v8::internal::AllocationAlignment) [node]
13: 0x1091415 v8::internal::FactoryBase<v8::internal::Factory>::AllocateRawOneByteInternalizedString(int, unsigned int) [node]
14: 0x10a1715 v8::internal::Factory::NewInternalizedStringImpl(v8::internal::Handle<v8::internal::String>, int, unsigned int) [node]
15: 0x13d9c64 v8::internal::Handle<v8::internal::String> v8::internal::StringTable::LookupKey<v8::internal::InternalizedStringKey, v8::internal::Isolate>(v8::internal::Isolate*, v8::internal::InternalizedStringKey*) [node]
16: 0x13d9e2f v8::internal::StringTable::LookupString(v8::internal::Isolate*, v8::internal::Handle<v8::internal::String>) [node]
17: 0x1502eab v8::internal::Runtime::SetObjectProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) [node]
18: 0x150453b v8::internal::Runtime_SetKeyedProperty(int, unsigned long*, v8::internal::Isolate*) [node]
19: 0x7f865e699ef6
Aborted (core dumped)
Here is my fuzzing harness:
const MarkdownIt = require('markdown-it');
function fuzz(data) {
try {
const input = data.toString('utf-8');
// Using commonmark mode
const mdCommonMark = new MarkdownIt('commonmark');
mdCommonMark.render(input);
// Using default mode
const mdDefault = new MarkdownIt();
mdDefault.render(input);
// Enabling everything
const mdEverythingEnabled = new MarkdownIt({
html: true,
linkify: true,
typographer: true
});
mdEverythingEnabled.render(input);
// Using full options list with defaults
const mdFullOptions = new MarkdownIt({
html: false,
xhtmlOut: false,
breaks: false,
langPrefix: 'language-',
linkify: false,
typographer: false,
quotes: '“”‘’',
highlight: function (/*str, lang*/) { return ''; }
});
mdFullOptions.render(input);
} catch (e) {
// If you encounter a specific error you want to ignore, handle it here.
// Otherwise, re-throw the error so the fuzzer can catch it.
throw e;
}
}
// Export the fuzz function for JazzerJS or any other fuzzer you're using
module.exports = { fuzz };
I wrote it for jsfuzz, but I will integrate it to jazzerjs which is full integrated with OSS
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels