[BUG] A SEGV at source/m3_compile.c:332:25 in MarkSlotAllocated #531
Description
Description
- Version: Latest commit 79d412e
- Environment:Ubuntu 20.04.6 LTS, Clang 10.0.0
Steps to reproduce
export CC="clang"
export CXX="clang++"
export CFLAGS="-fsanitize=address -g -O0"
export CXXFLAGS="-fsanitize=address -g -O0"
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
mkdir build && cd build
cmake -DBUILD_WASI=none ..
make -j$(nproc)
$CC $CFLAGS -c ../platforms/app_fuzz/fuzzer.c -o fuzzer.o -I../source
$CXX $CXXFLAGS $LIB_FUZZING_ENGINE -o fuzzer fuzzer.o source/libm3.a
./fuzzer $POCSanitizer output
root@2dca640e5e71:~/wasm3/build# ./fuzzer /root/wasm3_crash.txt
INFO: Seed: 193598872
./fuzzer: Running 1 inputs 1 time(s) each.
Running: /root/wasm3_crash.txt
AddressSanitizer:DEADLYSIGNAL
=================================================================
==590779==ERROR: AddressSanitizer: SEGV on unknown address 0x62600001052a (pc 0x0000005835c2 bp 0x7ffc01733d10 sp 0x7ffc01733b60 T0)
==590779==The signal is caused by a WRITE memory access.
#0 0x5835c2 in MarkSlotAllocated /root/wasm3/source/m3_compile.c:332:25
#1 0x5835c2 in MarkSlotsAllocated /root/wasm3/source/m3_compile.c:343:9
#2 0x5835c2 in MarkSlotsAllocatedByType /root/wasm3/source/m3_compile.c:350:5
#3 0x5835c2 in CompileBlock /root/wasm3/source/m3_compile.c:2740:13
#4 0x56274f in Compile_If /root/wasm3/source/m3_compile.c:1954:1
#5 0x5813e5 in CompileBlockStatements /root/wasm3/source/m3_compile.c:2608:1
#6 0x585ea8 in CompileFunction /root/wasm3/source/m3_compile.c:2908:1
#7 0x556930 in m3_FindFunction /root/wasm3/source/m3_env.c:750:1
#8 0x5504d0 in LLVMFuzzerTestOneInput /root/wasm3/build/../platforms/app_fuzz/fuzzer.c:33:30
#9 0x458681 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/root/wasm3/build/fuzzer+0x458681)
#10 0x443df2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/root/wasm3/build/fuzzer+0x443df2)
#11 0x4498a6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/root/wasm3/build/fuzzer+0x4498a6)
#12 0x472562 in main (/root/wasm3/build/fuzzer+0x472562)
#13 0x719520660082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
#14 0x41e4bd in _start (/root/wasm3/build/fuzzer+0x41e4bd)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/wasm3/source/m3_compile.c:332:25 in MarkSlotAllocated
==590779==ABORTING
POC
Credit
Reported by Yifan Zhang, PLL