171801 2017-05-08 03:49:13 -0700 Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname 2017-05-10 10:00:41 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 kamil.frankowicz fpizlo fpizlo ggaren jfbastien keith_miller mark.lam msaboff saam webkit-bug-importer ysuzuki oldest_to_newest 1305834 0 309352 kamil.frankowicz 2017-05-08 03:49:13 -0700 Created attachment 309352 POC to trigger null pointer dereference (jsc) Affected SVN revision: 216356 To reproduce the problem: ./jsc jsc_null_ptr_ref_ptr.js ASAN Output: ==21363==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f1a0150fc49 bp 0x7ffec7ffda30 sp 0x7ffec7ffd7c0 T0) ==21363==The signal is caused by a READ memory access. ==21363==Hint: address points to the zero page. #0 0x7f1a0150fc48 in WTF::RefPtr<WTF::StringImpl>::operator!() const /XYZ/WebKit/Source/WTF/wtf/RefPtr.h:76:38 #1 0x7f1a0150fc48 in WTF::String::isNull() const /XYZ/WebKit/Source/WTF/wtf/text/WTFString.h:150 #2 0x7f1a0150fc48 in JSC::JSString::isRope() const /XYZ/WebKit/Source/JavaScriptCore/runtime/JSString.h:208 #3 0x7f1a0150fc48 in JSC::JSString::toAtomicString(JSC::ExecState*) const /XYZ/WebKit/Source/JavaScriptCore/runtime/JSString.h:529 #4 0x7f1a0150fc48 in JSC::JSString::toIdentifier(JSC::ExecState*) const /XYZ/WebKit/Source/JavaScriptCore/runtime/JSString.h:524 #5 0x7f1a0150fc48 in slow_path_get_direct_pname /XYZ/WebKit/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:732 #6 0x7f1a00ce76d9 (/XYZ/WebKit/WebKitBuild/Release/lib/libJavaScriptCore.so.1+0x2b9f6d9) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /XYZ/WebKit/Source/WTF/wtf/RefPtr.h:76:38 in WTF::RefPtr<WTF::StringImpl>::operator!() const ==21363==ABORTING 1306225 1 webkit-bug-importer 2017-05-08 19:53:34 -0700 <rdar://problem/32066936> 1306865 2 309611 fpizlo 2017-05-10 09:04:55 -0700 Created attachment 309611 the patch 1306873 3 309611 msaboff 2017-05-10 09:11:10 -0700 Comment on attachment 309611 the patch r=me 1306901 4 fpizlo 2017-05-10 10:00:41 -0700 Landed in https://trac.webkit.org/changeset/216593/webkit 309352 2017-05-08 03:49:13 -0700 2017-05-10 09:04:55 -0700 POC to trigger null pointer dereference (jsc) jsc_null_ptr_ref_ptr.js application/javascript 87 kamil.frankowicz ZnVuY3Rpb24gZm9vKG8wKXt2YXIgbz1vMDtmb3IodmFyIHMgaW4gbyl7MFstLXNdfX1ub0lubGlu ZShmb28pCmZvcig7Oyl7Zm9vKHswOjAsYTowfSl9 309611 2017-05-10 09:04:55 -0700 2017-05-10 09:11:10 -0700 the patch blah.patch text/plain 5252 fpizlo SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMTY1ODUpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDIwIEBACisyMDE3LTA1LTEwICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5j b20+CisKKyAgICAgICAgTnVsbCBwb2ludGVyIGRlcmVmZXJlbmNlIGluIFdURjo6UmVmUHRyPFdU Rjo6U3RyaW5nSW1wbD46Om9wZXJhdG9yISgpIHVuZGVyIHNsb3dfcGF0aF9nZXRfZGlyZWN0X3Bu YW1lCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNzE4 MDEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAg ICAgIFRoZXNlIHRlc3RzIHVzZWQgdG8gY3Jhc2guIFRoZSBwcmVmaXggYW5kIHBvc3RmaXggdGVz dHMgY292ZXIgZGlmZmVyZW50IHBhdGhzLCBleGNlcHQKKyAgICAgICAgcG9zdGZpeC1pZ25vcmVk IGdvZXMgZG93biB0aGUgc2FtZSBwYXRoIGFzIHByZWZpeCBkdWUgdG8gYW4gb3B0aW1pemF0aW9u LgorCisgICAgICAgICogc3RyZXNzL2Zvci1pbi1wb3N0Zml4LWlnbm9yZWQtaW5kZXguanM6IEFk ZGVkLgorICAgICAgICAoZm9vKToKKyAgICAgICAgKiBzdHJlc3MvZm9yLWluLXBvc3RmaXgtaW5k ZXguanM6IEFkZGVkLgorICAgICAgICAoZm9vKToKKyAgICAgICAgKiBzdHJlc3MvZm9yLWluLXBy ZWZpeC1pbmRleC5qczogQWRkZWQuCisgICAgICAgIChmb28pOgorCiAyMDE3LTA1LTA4ICBNYXJr IExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBvcF90aHJvd19zdGF0aWNfZXJy b3IncyB1c2Ugb2YgaXRzIGZpcnN0IG9wZXJhbmQgc2hvdWxkIGJlIHJlZmxlY3RlZCBpbiBERkcg Qnl0ZWNvZGVVc2VEZWYgYXMgd2VsbC4KSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2Zvci1pbi1wb3N0 Zml4LWlnbm9yZWQtaW5kZXguanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvZm9yLWlu LXBvc3RmaXgtaWdub3JlZC1pbmRleC5qcwkobm9uZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVz cy9mb3ItaW4tcG9zdGZpeC1pZ25vcmVkLWluZGV4LmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAg KzEsMTIgQEAKK2Z1bmN0aW9uIGZvbyhvKSB7CisgICAgdmFyIHJlc3VsdCA9IDA7CisgICAgZm9y ICh2YXIgcyBpbiBvKSB7CisgICAgICAgIHMrKzsKKyAgICAgICAgcmVzdWx0ICs9IG9bc107Cisg ICAgfQorICAgIHJldHVybiByZXN1bHQ7Cit9CisKK3ZhciByZXN1bHQgPSBmb28oe2Y6NDJ9KTsK K2lmICgiIiArIHJlc3VsdCAhPSAiTmFOIikKKyAgICB0aHJvdyAiRXJyb3I6IGJhZCByZXN1bHQ6 ICIgKyByZXN1bHQ7CkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9mb3ItaW4tcG9zdGZpeC1pbmRleC5q cwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBKU1Rlc3RzL3N0cmVzcy9mb3ItaW4tcG9zdGZpeC1pbmRleC5qcwko bm9uZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVzcy9mb3ItaW4tcG9zdGZpeC1pbmRleC5qcwko d29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDEzIEBACitmdW5jdGlvbiBmb28obykgeworICAgIHZh ciByZXN1bHQgPSAwOworICAgIGZvciAodmFyIHMgaW4gbykgeworICAgICAgICB2YXIgdG1wID0g cysrOworICAgICAgICByZXN1bHQgKz0gb1tzXTsKKyAgICAgICAgcmVzdWx0ICs9IHRtcDsKKyAg ICB9CisgICAgcmV0dXJuIHJlc3VsdDsKK30KKwordmFyIHJlc3VsdCA9IGZvbyh7Zjo0Mn0pOwor aWYgKCIiICsgcmVzdWx0ICE9ICJOYU4iKQorICAgIHRocm93ICJFcnJvcjogYmFkIHJlc3VsdDog IiArIHJlc3VsdDsKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2Zvci1pbi1wcmVmaXgtaW5kZXguanMK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvZm9yLWluLXByZWZpeC1pbmRleC5qcwkobm9u ZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVzcy9mb3ItaW4tcHJlZml4LWluZGV4LmpzCSh3b3Jr aW5nIGNvcHkpCkBAIC0wLDAgKzEsMTAgQEAKK2Z1bmN0aW9uIGZvbyhvKSB7CisgICAgdmFyIHJl c3VsdCA9IDA7CisgICAgZm9yICh2YXIgcyBpbiBvKQorICAgICAgICByZXN1bHQgKz0gb1stLXNd OworICAgIHJldHVybiByZXN1bHQ7Cit9CisKK3ZhciByZXN1bHQgPSBmb28oe2Y6NDJ9KTsKK2lm ICgiIiArIHJlc3VsdCAhPSAiTmFOIikKKyAgICB0aHJvdyAiRXJyb3I6IGJhZCByZXN1bHQ6ICIg KyByZXN1bHQ7CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxNjU4NSkK KysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEs MyArMSwxOCBAQAorMjAxNy0wNS0xMCAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29tPgor CisgICAgICAgIE51bGwgcG9pbnRlciBkZXJlZmVyZW5jZSBpbiBXVEY6OlJlZlB0cjxXVEY6OlN0 cmluZ0ltcGw+OjpvcGVyYXRvciEoKSB1bmRlciBzbG93X3BhdGhfZ2V0X2RpcmVjdF9wbmFtZQor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTcxODAxCisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisgICAgICAgIAorICAgICAgICBU aGlzIHdhcyBhIGdvb2Z5IG92ZXJzaWdodC4gVGhlIGZvci1pbiBvcHRpbWl6YXRpb24gcmVsaWVz IG9uIHRoZSBieXRlY29kZSBnZW5lcmF0b3IKKyAgICAgICAgdG8gZGV0ZWN0IHdoZW4gdGhlIGxv b3AncyBpbmRleCB2YXJpYWJsZSBnZXRzIG11dGF0ZWQuIFdlIGZvcmdvdCB0byBoYXZlIHRoZSBo b29rcyBmb3IKKyAgICAgICAgZGV0ZWN0aW5nIHRoaXMgaW4gcHJlZml4IGFuZCBwb3N0Zml4IG9w ZXJhdGlvbnMgKCsraSBhbmQgaSsrKS4KKworICAgICAgICAqIGJ5dGVjb21waWxlci9Ob2Rlc0Nv ZGVnZW4uY3BwOgorICAgICAgICAoSlNDOjpQb3N0Zml4Tm9kZTo6ZW1pdFJlc29sdmUpOgorICAg ICAgICAoSlNDOjpQcmVmaXhOb2RlOjplbWl0UmVzb2x2ZSk6CisKIDIwMTctMDUtMTAgIE1pY2hh ZWwgQ2F0YW56YXJvICA8bWNhdGFuemFyb0BpZ2FsaWEuY29tPgogCiAgICAgICAgIFtHVEtdIC1X bWlzc2luZy1maWVsZC1pbml0aWFsaXplcnMgdHJpZ2dlcmVkIGJ5IFJlbW90ZUluc3BlY3RvclNl cnZlci5jcHA6MTI4CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL05v ZGVzQ29kZWdlbi5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVj b21waWxlci9Ob2Rlc0NvZGVnZW4uY3BwCShyZXZpc2lvbiAyMTY1NjEpCisrKyBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL05vZGVzQ29kZWdlbi5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTE0MTIsNiArMTQxMiw3IEBAIFJlZ2lzdGVySUQqIFBvc3RmaXhOb2RlOjplbWl0UmVzb2x2 ZShCeXQKICAgICAgICAgICAgIGdlbmVyYXRvci5lbWl0UmVhZE9ubHlFeGNlcHRpb25JZk5lZWRl ZCh2YXIpOwogICAgICAgICAgICAgbG9jYWxSZWcgPSBnZW5lcmF0b3IuZW1pdE1vdmUoZ2VuZXJh dG9yLnRlbXBEZXN0aW5hdGlvbihkc3QpLCBsb2NhbCk7CiAgICAgICAgIH0KKyAgICAgICAgZ2Vu ZXJhdG9yLmludmFsaWRhdGVGb3JJbkNvbnRleHRGb3JMb2NhbChsb2NhbCk7CiAgICAgICAgIFJl ZlB0cjxSZWdpc3RlcklEPiBvbGRWYWx1ZSA9IGVtaXRQb3N0SW5jT3JEZWMoZ2VuZXJhdG9yLCBn ZW5lcmF0b3IuZmluYWxEZXN0aW5hdGlvbihkc3QpLCBsb2NhbFJlZy5nZXQoKSwgbV9vcGVyYXRv cik7CiAgICAgICAgIGdlbmVyYXRvci5lbWl0UHJvZmlsZVR5cGUobG9jYWxSZWcuZ2V0KCksIHZh ciwgZGl2b3RTdGFydCgpLCBkaXZvdEVuZCgpKTsKICAgICAgICAgcmV0dXJuIG9sZFZhbHVlLmdl dCgpOwpAQCAtMTYyNCw2ICsxNjI1LDcgQEAgUmVnaXN0ZXJJRCogUHJlZml4Tm9kZTo6ZW1pdFJl c29sdmUoQnl0ZQogICAgICAgICAgICAgZ2VuZXJhdG9yLmVtaXRSZWFkT25seUV4Y2VwdGlvbklm TmVlZGVkKHZhcik7CiAgICAgICAgICAgICBsb2NhbFJlZyA9IGdlbmVyYXRvci5lbWl0TW92ZShn ZW5lcmF0b3IudGVtcERlc3RpbmF0aW9uKGRzdCksIGxvY2FsUmVnLmdldCgpKTsKICAgICAgICAg fSBlbHNlIGlmIChnZW5lcmF0b3Iudm0oKS0+dHlwZVByb2ZpbGVyKCkpIHsKKyAgICAgICAgICAg IGdlbmVyYXRvci5pbnZhbGlkYXRlRm9ySW5Db250ZXh0Rm9yTG9jYWwobG9jYWwpOwogICAgICAg ICAgICAgUmVmUHRyPFJlZ2lzdGVySUQ+IHRlbXBEc3QgPSBnZW5lcmF0b3IudGVtcERlc3RpbmF0 aW9uKGRzdCk7CiAgICAgICAgICAgICBnZW5lcmF0b3IuZW1pdE1vdmUodGVtcERzdC5nZXQoKSwg bG9jYWxSZWcuZ2V0KCkpOwogICAgICAgICAgICAgZW1pdEluY09yRGVjKGdlbmVyYXRvciwgdGVt cERzdC5nZXQoKSwgbV9vcGVyYXRvcik7CkBAIC0xNjMxLDYgKzE2MzMsNyBAQCBSZWdpc3RlcklE KiBQcmVmaXhOb2RlOjplbWl0UmVzb2x2ZShCeXRlCiAgICAgICAgICAgICBnZW5lcmF0b3IuZW1p dFByb2ZpbGVUeXBlKGxvY2FsUmVnLmdldCgpLCB2YXIsIGRpdm90U3RhcnQoKSwgZGl2b3RFbmQo KSk7CiAgICAgICAgICAgICByZXR1cm4gZ2VuZXJhdG9yLm1vdmVUb0Rlc3RpbmF0aW9uSWZOZWVk ZWQoZHN0LCB0ZW1wRHN0LmdldCgpKTsKICAgICAgICAgfQorICAgICAgICBnZW5lcmF0b3IuaW52 YWxpZGF0ZUZvckluQ29udGV4dEZvckxvY2FsKGxvY2FsKTsKICAgICAgICAgZW1pdEluY09yRGVj KGdlbmVyYXRvciwgbG9jYWxSZWcuZ2V0KCksIG1fb3BlcmF0b3IpOwogICAgICAgICByZXR1cm4g Z2VuZXJhdG9yLm1vdmVUb0Rlc3RpbmF0aW9uSWZOZWVkZWQoZHN0LCBsb2NhbFJlZy5nZXQoKSk7 CiAgICAgfQo=