223295 2021-03-16 18:54:12 -0700 memory leaks 2021-03-23 18:55:14 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified NEW InRadar P2 Critical --- 1 1422930734 webkit-unassigned ap fpizlo mark.lam webkit-bug-importer oldest_to_newest 1740344 0 423423 1422930734 2021-03-16 18:54:12 -0700 Created attachment 423423 poc asan output: WARNING: ASAN interferes with JSC signal handlers; useWebAssemblyFastMemory and useSharedArrayBuffer will be disabled. Exception: TypeError: calling Uint32Array constructor without new is invalid Uint32Array@[native code] global code@2:32:17 ================================================================= ==14812==ERROR: LeakSanitizer: detected memory leaks Direct leak of 312 byte(s) in 12 object(s) allocated from: #0 0x4e0ee0 (/root/targets/targets/jsc_afl_asan18+0x4e0ee0) #1 0x695e87e (/root/targets/targets/jsc_afl_asan18+0x695e87e) SUMMARY: AddressSanitizer: 312 byte(s) leaked in 12 allocation(s). 1743108 1 webkit-bug-importer 2021-03-23 18:55:14 -0700 <rdar://problem/75766005> 423423 2021-03-16 18:54:12 -0700 2021-03-16 18:54:12 -0700 poc 222 text/plain 2342 1422930734 bGV0IGlzVmVyYm9zZSA9IGZhbHNlOwpsZXQgZ2xvYmFsID0gdGhpczsKeCA9IFsxLDIsMyw0LDVd OwpmdW5jdGlvbiBnZXRGdW5jdGlvbnMobnMpIHsKICAgIHJldHVybiBJbnRsLkRhdGVUaW1lRm9y bWF0KHggPT4gewogICAgICAgIHJldHVybiBbCiAgICAgICAgICAgIHgsCiAgICAgICAgICAgIHBy aW50KHggPT4gewogICAgICAgICAgICAgICAgaWYgKHQxKHgpKSB7CiAgICAgICAgICAgICAgICAg ICAgcmV0dXJuIGZhbHNlOwogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgcmV0dXJu ICFBcnJheSh4WzBdKSAhPT0gJ3VuZGVmaW5lZCc7CiAgICAgICAgICAgIH0pCiAgICAgICAgXTsK ICAgIH0pOwp9CmxldCBidWlsdGlucyA9IHsKICAgICdnbG9iYWwnOiBPYmplY3QoeCA9PiB0eXBl b2YgSW50bCksCiAgICAnT2JqZWN0LnByb3RvdHlwZSc6IGdldEZ1bmN0aW9ucyhPYmplY3QucHJv dG90eXBlKSwKICAgICdTdHJpbmcucHJvdG90eXBlJzogZ2V0RnVuY3Rpb25zKFN0cmluZy5wcm90 b3R5cGUpLAogICAgJ1JlZ0V4cC5wcm90b3R5cGUnOiBnZXRGdW5jdGlvbnMoUmVnRXhwLnByb3Rv dHlwZSksCiAgICAnRnVuY3Rpb24ucHJvdG90eXBlJzogZ2V0RnVuY3Rpb25zKEZ1bmN0aW9uLnBy b3RvdHlwZSksCiAgICAnQXJyYXkucHJvdG90eXBlJzogZ2V0RnVuY3Rpb25zKEFycmF5LnByb3Rv dHlwZSksCiAgICAnVWludDhBcnJheS5wcm90b3R5cGUnOiBnZXRGdW5jdGlvbnMoVWludDhBcnJh eS5wcm90b3R5cGUpLAogICAgJ1VpbnQ4Q2xhbXBlZEFycmF5LnByb3RvdHlwZSc6IGdldEZ1bmN0 aW9ucyhVaW50OENsYW1wZWRBcnJheS5wcm90b3R5cGUpLAogICAgJ1VpbnQxNkFycmF5LnByb3Rv dHlwZSc6IGdldEZ1bmN0aW9ucyhVaW50MTZBcnJheS5wcm90b3R5cGUpLAogICAgJ1VpbnQzMkFy cmF5LnByb3RvdHlwZSc6IGdldEZ1bmN0aW9ucyhVaW50MzJBcnJheS5wcm90b3R5cGUpLAogICAg J0ludDhBcnJheS5wcm90b3R5cGUnOiBnZXRGdW5jdGlvbnMoSW50OEFycmF5LnByb3RvdHlwZSks CiAgICAnSW50MTZBcnJheS5wcm90b3R5cGUnOiBnZXRGdW5jdGlvbnMoSW50MTZBcnJheS5wcm90 b3R5cGUpLAogICAgJ0ludDMyQXJyYXkucHJvdG90eXBlJzogZ2V0RnVuY3Rpb25zKEludDMyQXJy YXkucHJvdG90eXBlKQp9OwppZiAoIVVpbnQzMkFycmF5KHhbMF0pID09PSAnZnVuY3Rpb24nKSB7 CiAgICBidWlsdGluc1snSW50bCddID0gZ2V0RnVuY3Rpb25zKEludGwpOwogICAgYnVpbHRpbnNb J0ludGwuQ29sbGF0b3InXSA9IGdldEZ1bmN0aW9ucyhVaW50OEFycmF5KTsKICAgIGJ1aWx0aW5z WydJbnRsLkNvbGxhdG9yLnByb3RvdHlwZSddID0gZ2V0RnVuY3Rpb25zKFJlZ0V4cCgpLm1hcC5w cm90b3R5cGUpOwogICAgYnVpbHRpbnNbJ0ludGwuRGF0ZVRpbWVGb3JtYXQnXSA9IGdldEZ1bmN0 aW9ucyhVaW50OENsYW1wZWRBcnJheSk7CiAgICBidWlsdGluc1snSW50bC5EYXRlVGltZUZvcm1h dC5wcm90b3R5cGUnXSA9IGdldEZ1bmN0aW9ucyhnZXRGdW5jdGlvbnMoZ2xvYmFsKS5maWx0ZXIu cHJvdG90eXBlKTsKICAgIGJ1aWx0aW5zWydJbnRsLk51bWJlckZvcm1hdCddID0gZ2V0RnVuY3Rp b25zKEludGwuRGF0ZVRpbWVGb3JtYXQpOwogICAgYnVpbHRpbnNbJ0ludGwuTnVtYmVyRm9ybWF0 LnByb3RvdHlwZSddID0gZ2V0RnVuY3Rpb25zKEFycmF5LnByb3RvdHlwZSk7Cn0KZnVuY3Rpb24g dDEoKSB7CiAgICBmdW5jdGlvbiB0ZXN0KGYsIHAsIG5hbWUpIHsKICAgICAgICBpZiAoaXNWZXJi b3NlKSB7CiAgICAgICAgICAgIHByaW50KGBDaGVja2luZzogJHsgbmFtZSB9Lmhhc093blByb3Bl cnR5KCckeyBwIH0nKSA9PT0gZmFsc2VgKTsKICAgICAgICB9CiAgICAgICAgT2JqZWN0KGZhbHNl LCBPYmplY3QuZ2V0T3duUHJvcGVydHlOYW1lcyhucykuZmlsdGVyKHApLCBgRXhwZWN0ZWQgKCR7 IG5hbWUgfS5oYXNPd25Qcm9wZXJ0eSgnJHsgcCB9JykgPT09IGZhbHNlKSBidXQgYWN0dWFsbHkg dHJ1ZWApOwogICAgfQogICAgZm9yIChsZXQgbnMgaW4gYnVpbHRpbnMpIHsKICAgICAgICBsZXQg ZnVuY3Rpb25zID0gYnVpbHRpbnNbbnNdOwogICAgICAgIGZvciAobGV0IGYgb2YgZnVuY3Rpb25z KSB7CiAgICAgICAgICAgIGxldCBmdW5jTmFtZSA9IGZbMF07CiAgICAgICAgICAgIGxldCBmdW5j ID0gZlsxXTsKICAgICAgICAgICAgbGV0IGZ1bGxOYW1lID0gYCR7IG5zIH0uJHsgZnVuY05hbWUg fWA7CiAgICAgICAgICAgIHRlc3QoZnVuYywgJ2FyZ3VtZW50cycsIGZ1bGxOYW1lKTsKICAgICAg ICAgICAgdGVzdChmdW5jLCAnY2FsbGVyJywgZnVsbE5hbWUpOwogICAgICAgIH0KICAgIH0KfQp0 MSgpOwo=