222542 2021-03-01 04:10:01 -0800 Crash calling the "load" function on a too large file in the jsc command line tool 2022-01-31 08:38:52 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Linux NEW InRadar P2 Critical --- 1 1422930734 ysuzuki bfulgham darin webkit-bug-importer ysuzuki oldest_to_newest 1734373 0 421808 1422930734 2021-03-01 04:10:01 -0800 Created attachment 421808 poc 0x7ffff4681fab <raise+187> mov edi, 0x2 0x7ffff4681fb0 <raise+192> mov eax, 0xe 0x7ffff4681fb5 <raise+197> syscall → 0x7ffff4681fb7 <raise+199> mov rcx, QWORD PTR [rsp+0x108] 0x7ffff4681fbf <raise+207> xor rcx, QWORD PTR fs:0x28 0x7ffff4681fc8 <raise+216> mov eax, r8d 0x7ffff4681fcb <raise+219> jne 0x7ffff4681fec <__GI_raise+252> 0x7ffff4681fcd <raise+221> add rsp, 0x118 0x7ffff4681fd4 <raise+228> ret ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ──── [#0] Id 1, Name: "jsc_afl_asan18", stopped, reason: SIGABRT ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ──── [#0] 0x7ffff4681fb7 → __GI_raise(sig=0x6) [#1] 0x7ffff4683921 → __GI_abort() [#2] 0x59c516 → allocateBuffer<WTF::FailureAction::Crash>() [#3] 0x5ef736 → reserveCapacity<WTF::FailureAction::Crash>() [#4] 0x5ef3e3 → expandCapacity<WTF::FailureAction::Crash>() [#5] 0x5eec66 → resize() [#6] 0x5851ab → fillBufferWithContentsOfFile<WTF::Vector<char, 0, WTF::CrashOnOverflow, 16, WTF::FastMalloc> >() [#7] 0x5851ab → fillBufferWithContentsOfFile() [#8] 0x5851ab → fetchScriptFromLocalFileSystem() [#9] 0x54378d → functionLoad() 1734374 1 webkit-bug-importer 2021-03-01 04:10:14 -0800 <rdar://problem/74863969> 1734472 2 darin 2021-03-01 09:54:52 -0800 This intentional crash is a policy of the "jsc" command line tool, not of JavaScriptCore itself. Could easily be changed, but is not a JavaScriptCore security bug. 1734474 3 darin 2021-03-01 09:55:32 -0800 Trivial to fix by adding a tryReserveCapacity call to the fillBufferWithContentsOfFile function. 1734686 4 1422930734 2021-03-01 16:47:11 -0800 Can you give me a CVE number? 1734721 5 darin 2021-03-01 18:26:14 -0800 I don’t think this is a security bug since it’s specific to the "jsc" command line tool. It interferes with fuzzing, but has no effect on security of web browsers using JavaScriptCore, for example. 1740395 6 ysuzuki 2021-03-16 23:06:48 -0700 Yes. This is not a security issue since it always crashes and it only exists in JSC shell (this is not included in WebContent process). 421808 2021-03-01 04:10:01 -0800 2021-03-01 04:10:01 -0800 poc crash_jsc_0 text/plain 332 1422930734 bG9hZCgnJyk7CmxvYWQoJycpOwpjb25zdCBidWlsZGVyID0gbmV3IFdhc21Nb2R1bGVCdWlsZGVy KCk7CmJ1aWxkZXIuYWRkTWVtb3J5KDE2LCAzMik7CmJ1aWxkZXIuYWRkRnVuY3Rpb24oJyh7fSkn LCBrU2lnX2lfdikuYWRkQm9keShbCiAgICBrRXhwckkzMkNvbnN0LAogICAgMTIKXSk7CmxldCBi bGEgPSA3MTg7CmxldCBtb2R1bGUgPSBuZXcgV2ViQXNzZW1ibHkuTW9kdWxlKGJ1aWxkZXIudG9C dWZmZXIoKSk7Cm1vZHVsZS50aGVuID0gcmVzb2x2ZSA9PiB7CiAgICByZXR1cm4gcmVzb2x2ZSgx MDk0Nzk1NTg1KTsKfTsKV2ViQXNzZW1ibHkuaW5zdGFudGlhdGUobW9kdWxlKTs=