crashappsec / crashappsec/libcon4m

SIGSEGV: various for dicts

Open
#90 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

These may be known or out-of-scope for now, but let's track in this issue.

Some examples with:

- libcon4m https://github.com/crashappsec/libcon4m/commit/1da1ac50ee6f30e1f468b21d903de10e827b2d57 (on `main`)
- x86_64
- Linux 6.10.0
- clang 18.1.8

### Setting key before declaring dict

```text
a["foo"] = 1
```

```text
Invalid read of size 8
at 0x13593D: c4m_vtable (object.h:15)
by 0x135E6C: c4m_index_set (../src/core/object.c:698)
by 0x132413: c4m_vm_tcall (../src/core/vm.c:526)
by 0x12EF8A: c4m_vm_runloop (../src/core/vm.c:1355)
by 0x12B02E: c4m_vmthread_run (../src/core/vm.c:1759)
by 0x119B10: execute_test (../src/harness/con4m_base/run.c:43)
by 0x119224: run_one_item (../src/harness/con4m_base/run.c:61)
by 0x119172: c4m_run_expected_value_tests (../src/harness/con4m_base/run.c:152)
by 0x117DDB: main (../src/harness/con4m_base/test.c:55)
Address 0xfffffffffffffff0 is not stack'd, malloc'd or (recently) free'd
```

### Setting key of different type

```text
b = { "foo" : 1 }
b[1] = 2
```

```text
Invalid read of size 8
at 0x13E7F3: c4m_custom_string_hash (../src/adts/dict.c:37)
by 0x1A085F: hatrack_dict_get_hash_value (../src/hatrack/hash/dict.c:692)
by 0x1A0BE7: hatrack_dict_put_mmm (../src/hatrack/hash/dict.c:280)
by 0x1A0D44: hatrack_dict_put (../src/hatrack/hash/dict.c:316)
by 0x135EDA: c4m_index_set (../src/core/object.c:704)
by 0x132413: c4m_vm_tcall (../src/core/vm.c:526)
by 0x12EF8A: c4m_vm_runloop (../src/core/vm.c:1355)
by 0x12B02E: c4m_vmthread_run (../src/core/vm.c:1759)
by 0x119B10: execute_test (../src/harness/con4m_base/run.c:43)
by 0x119224: run_one_item (../src/harness/con4m_base/run.c:61)
by 0x119172: c4m_run_expected_value_tests (../src/harness/con4m_base/run.c:152)
by 0x117DDB: main (../src/harness/con4m_base/test.c:55)
Address 0xffffffffffffffe1 is not stack'd, malloc'd or (recently) free'd
```

### Setting key when variable is not a dict

```text
c = 1
c["foo"] = 2
```

```text
Invalid read of size 4
at 0x504CB19: __pthread_rwlock_wrlock_full64 (pthread_rwlock_common.c:603)
by 0x504CB19: pthread_rwlock_wrlock@@GLIBC_2.34 (pthread_rwlock_wrlock.c:26)
by 0x1440A0: c4m_list_get (../src/adts/list.c:143)
by 0x17F50F: c4m_type_get_param (type.h:142)
by 0x17B186: handle_index (../src/compiler/check_pass.c:904)
by 0x17A12D: base_check_pass_dispatch (../src/compiler/check_pass.c:2286)
by 0x17DB74: process_children (../src/compiler/check_pass.c:606)
by 0x17A24F: base_check_pass_dispatch (../src/compiler/check_pass.c:2365)
by 0x18093C: base_handle_assign (../src/compiler/check_pass.c:2008)
by 0x17D496: handle_assign (../src/compiler/check_pass.c:2026)
by 0x17A1B9: base_check_pass_dispatch (../src/compiler/check_pass.c:2326)
by 0x179DDC: check_pass_toplevel_dispatch (../src/compiler/check_pass.c:2409)
by 0x179E94: process_toplevel_children (../src/compiler/check_pass.c:2380)
Address 0x28 is not stack'd, malloc'd or (recently) free'd
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.