dynamic-stack-buffer-overflow in ws_send_data
renatahodovan opened this issue · comments
IoT.js version:
Checked revision: a5957f8
Build command: ./tools/build.py --clean --buildtype=debug --target-arch=i686 \
--compile-flag=-fsanitize=address --compile-flag=-O2 \
--compile-flag=-fno-common --compile-flag=-fno-omit-frame-pointer \
--jerry-cmake-param=-DFEATURE_SYSTEM_ALLOCATOR=ON --no-snapshot \
--profile=test/profiles/host-linux.profile --jerry-profile=es2015-subset
OS:
Linux-5.0.0-17-generic-x86_64-with-Ubuntu-19.04-disco
Test case:
var websocket = require('websocket');
var client = new websocket.Websocket();
var client2 = new websocket.Websocket();
var wss = new websocket.Server({port: 8081}, function () {});
client.connect('ws://localhost', 8081, '/', function() {
client2.connect('ws://localhost', 8081, '/');
client2.on('open', function() {
wss.broadcast('a');
});
});Backtrace:
=================================================================
==8214==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0xffcc4b8c at pc 0x080ac140 bp 0xffcc4998 sp 0xffcc4988
READ of size 4 at 0xffcc4b8c thread T0
#0 0x80ac13f in ws_send_data iotjs/src/modules/iotjs_module_websocket.c:739
#1 0x810ff14 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:815
#2 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#3 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#4 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#5 0x8110101 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#6 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#7 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#8 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#9 0x810fac9 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#10 0x8170324 in ecma_builtin_function_prototype_object_apply iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtin-function-prototype.c:167
#11 0x8170324 in ecma_builtin_function_prototype_dispatch_routine iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtin-function-prototype.inc.h:41
#12 0x80cca49 in ecma_builtin_dispatch_routine iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtins.c:1016
#13 0x80cca49 in ecma_builtin_dispatch_call iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtins.c:1041
#14 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#15 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#16 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#17 0x8110101 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#18 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#19 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#20 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#21 0x810fac9 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#22 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#23 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#24 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#25 0x810fac9 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#26 0x8170324 in ecma_builtin_function_prototype_object_apply iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtin-function-prototype.c:167
#27 0x8170324 in ecma_builtin_function_prototype_dispatch_routine iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtin-function-prototype.inc.h:41
#28 0x80cca49 in ecma_builtin_dispatch_routine iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtins.c:1016
#29 0x80cca49 in ecma_builtin_dispatch_call iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtins.c:1041
#30 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#31 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#32 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#33 0x8110101 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#34 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#35 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#36 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#37 0x810fac9 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#38 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#39 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#40 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#41 0x810fac9 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#42 0x816ff21 in ecma_builtin_function_prototype_object_call iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtin-function-prototype.c:219
#43 0x816ff21 in ecma_builtin_function_prototype_dispatch_routine iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtin-function-prototype.inc.h:42
#44 0x80cca49 in ecma_builtin_dispatch_routine iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtins.c:1016
#45 0x80cca49 in ecma_builtin_dispatch_call iotjs/deps/jerry/jerry-core/ecma/builtin-objects/ecma-builtins.c:1041
#46 0x8199e4a in opfunc_call iotjs/deps/jerry/jerry-core/vm/vm.c:565
#47 0x8199e4a in vm_execute iotjs/deps/jerry/jerry-core/vm/vm.c:3478
#48 0x810f6d3 in vm_run iotjs/deps/jerry/jerry-core/vm/vm.c:3611
#49 0x810fac9 in ecma_op_function_call iotjs/deps/jerry/jerry-core/ecma/operations/ecma-function-object.c:792
#50 0x8153700 in jerry_invoke_function iotjs/deps/jerry/jerry-core/api/jerry.c:2405
#51 0x806b694 in iotjs_invoke_callback_with_result iotjs/src/iotjs_binding_helper.c:121
#52 0x806b694 in iotjs_invoke_callback_with_result iotjs/src/iotjs_binding_helper.c:110
#53 0x806b7a1 in iotjs_invoke_callback iotjs/src/iotjs_binding_helper.c:106
#54 0x809e1e3 in on_read iotjs/src/modules/iotjs_module_tcp.c:293
#55 0x81c35c7 in uv__read iotjs/deps/libtuv/src/unix/stream.c:1245
#56 0x81c3d92 in uv__stream_io iotjs/deps/libtuv/src/unix/stream.c:1311
#57 0x81d41d9 in uv__io_poll iotjs/deps/libtuv/src/unix/linux-core.c:389
#58 0x81aa785 in uv_run iotjs/deps/libtuv/src/unix/core.c:327
#59 0x80692e2 in iotjs_start iotjs/src/iotjs.c:233
#60 0x80692e2 in iotjs_entry iotjs/src/iotjs.c:312
#61 0x8067586 in main iotjs/src/platform/linux/iotjs_linux.c:19
#62 0xf75e7750 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x1e750)
#63 0x8068401 in _start (iotjs/build_clean/i686-linux/debug/bin/iotjs+0x8068401)
Address 0xffcc4b8c is located in stack of thread T0 at offset 444 in frame
#0 0x80abe8f in ws_send_data iotjs/src/modules/iotjs_module_websocket.c:727
This frame has 1 object(s):
[32, 40) 'msg' <== Memory access at offset 444 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow iotjs/src/modules/iotjs_module_websocket.c:739 in ws_send_data
Shadow bytes around the buggy address:
0x3ff98920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ff98930: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2
0x3ff98940: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ff98950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ff98960: 00 00 00 00 00 00 00 00 ca ca ca ca 00 00 00 00
=>0x3ff98970: 00[04]cb cb cb cb cb cb 00 00 00 00 00 00 00 00
0x3ff98980: f1 f1 f1 f1 00 00 00 00 00 00 04 f2 f3 f3 f3 f3
0x3ff98990: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ff989a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ff989b0: 00 00 00 00 ca ca ca ca 00 00 cb cb cb cb cb cb
0x3ff989c0: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==8214==ABORTING