Skip to content

JS_DumpMemoryUsage will crash if u use promise#1046

Merged
saghul merged 2 commits intoquickjs-ng:masterfrom
sallmann:master
May 13, 2025
Merged

JS_DumpMemoryUsage will crash if u use promise#1046
saghul merged 2 commits intoquickjs-ng:masterfrom
sallmann:master

Conversation

@sallmann
Copy link
Copy Markdown
Contributor

@sallmann sallmann commented May 2, 2025

@bnoordhuis
Copy link
Copy Markdown
Contributor

bnoordhuis commented May 2, 2025

LGTM but can you add a regression test to api-test.c? Did you author this line of code or is it Fabrice's?

@sallmann
Copy link
Copy Markdown
Contributor Author

sallmann commented May 2, 2025

The work is actually from Fabrice.

I corrected the code according his actual commit and added the regression test.

Without the change it would output with activated AddressSanitizer:

add_compile_options(-fsanitize=address)
add_link_options(-fsanitize=address)

dev@dev /home/dev/projects/github/quickjs/build $ ./api-test
=================================================================
==19945==ERROR: AddressSanitizer: global-buffer-overflow on address 0x6413034c2a00 at pc 0x641303240556 bp 0x7ffe2c113100 sp 0x7ffe2c1130f0
READ of size 4 at 0x6413034c2a00 thread T0
    #0 0x641303240555 in JS_DumpMemoryUsage (/home/dev/projects/github/quickjs/build/api-test+0x3e555) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19)
    #1 0x64130322a5dd in main (/home/dev/projects/github/quickjs/build/api-test+0x285dd) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19)
    #2 0x7d4fe6835487  (/usr/lib/libc.so.6+0x27487) (BuildId: d056ce83eebe65ce7e52ecfa5af5363e4863d283)
    #3 0x7d4fe683554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: d056ce83eebe65ce7e52ecfa5af5363e4863d283)
    #4 0x64130322a8c4 in _start (/home/dev/projects/github/quickjs/build/api-test+0x288c4) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19)

0x6413034c2a00 is located 32 bytes before global variable 'js_module_ns_exotic_methods' defined in '/home/dev/projects/github/quickjs/quickjs.c:28329:35' (0x6413034c2a20) of size 56
0x6413034c2a00 is located 24 bytes after global variable 'js_std_class_def' defined in '/home/dev/projects/github/quickjs/quickjs.c:1691:30' (0x6413034c2580) of size 1128
SUMMARY: AddressSanitizer: global-buffer-overflow (/home/dev/projects/github/quickjs/build/api-test+0x3e555) (BuildId: 3f6ba0f81ae427e4dd0258e55d0115d9150d5c19) in JS_DumpMemoryUsage
Shadow bytes around the buggy address:
  0x6413034c2780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
=>0x6413034c2a00:[f9]f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
  0x6413034c2a80: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
  0x6413034c2b00: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9
  0x6413034c2b80: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
  0x6413034c2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x6413034c2c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==19945==ABORTING

@saghul saghul merged commit 7e8abe1 into quickjs-ng:master May 13, 2025
127 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@saghul saghul saghul approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

JS_DumpMemoryUsage will crash if u use promise

3 participants

@sallmann @bnoordhuis @saghul