NULL pointer dereference in function getLiveInValue, file lib/Optimizer/Scalar/Mem2Reg.cpp
- Dominant language
- JavaScript
- Stars
- 11.3k
- Forks
- 859
- Avg merge
- 1h 30m
- Merged PRs (30d)
- 3
Description
## Bug Description
Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/86d391d
React Native version: N/A
OS: 5.15.0-101-generic #111-Ubuntu SMP x86_64 GNU/Linux
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): x86_64
## Steps To Reproduce
1. Build hermes from source (I used clang16) from the associated commit (86d391d) with ASAN and the following cmake flags:
"-DHERMES_ENABLE_LIBFUZZER=1"
"-DHERMES_ENABLE_WERROR=0"
"-DHERMES_THREAD_SAFETY_ANALYSIS=0"
"-DHERMES_ENABLE_TEST_SUITE=0"
2. Run hermes with the JS PoC available in this archive: [ASAN_002982741_fuzzer_1.zip](https://github.com/user-attachments/files/15536559/ASAN_002982741_fuzzer_1.zip)
PoC:
```
yield [1,2,3] !== function from( { [ new as ( )]: [] } , as ) { } ( )
{ }
```
ASAN trace:
```
> ./hermes ASAN_002982741_fuzzer_1
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3068628==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x556aa3a80891 bp 0x60d0000018a0 sp 0x7fff3ab5e060 T0)
==3068628==The signal is caused by a READ memory access.
==3068628==Hint: address points to the zero page.
#0 0x556aa3a80891 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x757891)
#1 0x556aa3a53094 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x72a094)
#2 0x556aa3813913 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x4ea913)
#3 0x556aa34e369a (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x1ba69a)
#4 0x7fa66935ffcd (/nix/store/j0by58xwyc66f884x0q8rpzvgpwvjmf2-glibc-2.38-77/lib/libc.so.6+0x27fcd) (BuildId: 988e7c95904375296e2763be4c7b5406afce4f5a)
#5 0x7fa669360088 (/nix/store/j0by58xwyc66f884x0q8rpzvgpwvjmf2-glibc-2.38-77/lib/libc.so.6+0x28088) (BuildId: 988e7c95904375296e2763be4c7b5406afce4f5a)
#6 0x556aa33b5ac4 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x8cac4)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x757891)
==3068628==ABORTING
```
## Backtrace

The NULL pointer dereference is caused because IDom points to 0x0:
https://github.com/facebook/hermes/blob/86d391d00be80aeccc8b29f62a254ecf6bc8a9ae/lib/Optimizer/Scalar/Mem2Reg.cpp#L592
## Notes
Possibly duplicate of: https://github.com/facebook/hermes/issues/1357
Contributor guide
Assessment
This issue has not been assessed yet.