Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nullptr deref in ConstantFoldNode with malformed input #137

Open
niv opened this issue Oct 13, 2024 · 0 comments
Open

nullptr deref in ConstantFoldNode with malformed input #137

niv opened this issue Oct 13, 2024 · 0 comments

Comments

@niv
Copy link
Owner

niv commented Oct 13, 2024

Ran on minmised nwscript.nss with all optimisations enabled.

Stacks vary between crashes, all end up at the same frame though.

==57507==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x000104a712bc bp 0x00016b3b4fe0 sp 0x00016b3b4780 T0)
==57507==The signal is caused by a READ memory access.
==57507==Hint: address points to the zero page.
    #0 0x104a712bc in CScriptCompiler::ConstantFoldNode(CScriptParseTreeNode*, int)+0x2110 (afl-diag:arm64+0x1000312bc)
    #1 0x104a90508 in CScriptCompiler::GenerateIdentifiersFromConstantVariables(CScriptParseTreeNode*)+0x1498 (afl-diag:arm64+0x100050508)
    #2 0x104b4fc64 in CScriptCompiler::GenerateParseTree()+0x31000 (afl-diag:arm64+0x10010fc64)
    #3 0x104b12758 in CScriptCompiler::HandleToken()+0xb8 (afl-diag:arm64+0x1000d2758)
    #4 0x104b180e8 in CScriptCompiler::ParseCharacterSemicolon()+0x108 (afl-diag:arm64+0x1000d80e8)
    #5 0x104b1aa2c in CScriptCompiler::ParseNextCharacter(int, int, char const*, int)+0xf30 (afl-diag:arm64+0x1000daa2c)
    #6 0x104b5ab08 in CScriptCompiler::ParseSource(char const*, int)+0x258 (afl-diag:arm64+0x10011ab08)
    #7 0x104a6d52c in CScriptCompiler::CompileScriptChunk(CExoString const&, int)+0x400 (afl-diag:arm64+0x10002d52c)
    #8 0x104b5b88c in main+0x720 (afl-diag:arm64+0x10011b88c)
    #9 0x18c6c4270  (<unknown module>)

Above stack generated with asan enabled when attempting to compile

id:000099,sig:11,src:001437+001621,time:2661673,execs:46244036,op:splice,rep:10.txt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant