facebook / facebook/hermes

NULL pointer dereference in function getLiveInValue, file lib/Optimizer/Scalar/Mem2Reg.cpp

Open
#1,416 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
11.3k
Forks
859
Avg merge
1h 30m
Merged PRs (30d)
3

Description

## Bug Description

Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/86d391d
React Native version: N/A
OS: 5.15.0-101-generic #111-Ubuntu SMP x86_64 GNU/Linux
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): x86_64

## Steps To Reproduce
1. Build hermes from source (I used clang16) from the associated commit (86d391d) with ASAN and the following cmake flags:
"-DHERMES_ENABLE_LIBFUZZER=1"
"-DHERMES_ENABLE_WERROR=0"
"-DHERMES_THREAD_SAFETY_ANALYSIS=0"
"-DHERMES_ENABLE_TEST_SUITE=0"
2. Run hermes with the JS PoC available in this archive: [ASAN_002982741_fuzzer_1.zip](https://github.com/user-attachments/files/15536559/ASAN_002982741_fuzzer_1.zip)

PoC:
```
yield [1,2,3] !== function from( { [ new as ( )]: [] } , as ) { } ( )
{ }

```
ASAN trace:
```
> ./hermes ASAN_002982741_fuzzer_1
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3068628==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x556aa3a80891 bp 0x60d0000018a0 sp 0x7fff3ab5e060 T0)
==3068628==The signal is caused by a READ memory access.
==3068628==Hint: address points to the zero page.
#0 0x556aa3a80891 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x757891)
#1 0x556aa3a53094 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x72a094)
#2 0x556aa3813913 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x4ea913)
#3 0x556aa34e369a (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x1ba69a)
#4 0x7fa66935ffcd (/nix/store/j0by58xwyc66f884x0q8rpzvgpwvjmf2-glibc-2.38-77/lib/libc.so.6+0x27fcd) (BuildId: 988e7c95904375296e2763be4c7b5406afce4f5a)
#5 0x7fa669360088 (/nix/store/j0by58xwyc66f884x0q8rpzvgpwvjmf2-glibc-2.38-77/lib/libc.so.6+0x28088) (BuildId: 988e7c95904375296e2763be4c7b5406afce4f5a)
#6 0x556aa33b5ac4 (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x8cac4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x757891)
==3068628==ABORTING
```
## Backtrace
![image](https://github.com/facebook/hermes/assets/62700746/16a7fe13-ca2d-4959-af92-b6708936a3fd)

The NULL pointer dereference is caused because IDom points to 0x0:
https://github.com/facebook/hermes/blob/86d391d00be80aeccc8b29f62a254ecf6bc8a9ae/lib/Optimizer/Scalar/Mem2Reg.cpp#L592

## Notes
Possibly duplicate of: https://github.com/facebook/hermes/issues/1357

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.