Skip to content

Fix NULL pointer dereference in the module linker on a duplicate binding - #5313

Open
PGZXB wants to merge 1 commit into
jerryscript-project:masterfrom
PGZXB:fix-issue-5292
Open

PGZXB wants to merge 1 commit into
jerryscript-project:masterfrom
PGZXB:fix-issue-5292

Conversation

@PGZXB

@PGZXB PGZXB commented Sep 25, 2026

Copy link
Copy Markdown

A module whose top-level binding is declared with var/function and then
re-declared by a namespace import (import * as name) is accepted, although
ECMA-262 makes duplicate top-level module binding names an early SyntaxError.
The scanner already records SCANNER_TYPE_ERR_REDECLARED for the imported name
and the named-import clause rejects it, but the namespace-import branch of
parser_parse_import_statement() never performed that check. The name is then
referenced from the module scope while absent from module_p->imports_p, and
during linking ecma_module_resolve_export() falls through to
ecma_module_resolve_import(). That function walks imports_p with an
unbounded while (true) loop whose only terminating guard is a JERRY_ASSERT
(compiled out in release builds), so it dereferences
import_node_p->module_names_p after import_node_p has reached NULL:

// m0.mjs
var z = {};
import * as z from "./m1.mjs";
export default 1;
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008
    #0 ecma_module_resolve_import jerry-core/ecma/base/ecma-module.c
    #1 ecma_module_resolve_export jerry-core/ecma/base/ecma-module.c:446
    #2 ecma_module_namespace_object_add_export_if_needed ... ecma-module.c:641

The namespace-import path now performs the same redeclaration check that
parser_module_parse_import_clause() already uses, so the duplicate binding is
rejected as a SyntaxError while the module is parsed. As defence in depth,
ecma_module_resolve_import() now stops when it runs out of import nodes and
returns false (resolution failure) instead of relying on an assertion; the
caller already handles an unsuccessful resolution.

Verified with the shipped CLI in module mode (jerry -m):

  • before the change: SUMMARY: AddressSanitizer: SEGV ... in ecma_module_resolve_import
  • after the change: Unhandled exception: SyntaxError, no sanitizer report
  • a valid namespace import (import * as z from "./m1.mjs") still links and
    evaluates cleanly, so existing module programs are unaffected

Fixes #5292

JerryScript-DCO-1.0-Signed-off-by: PGZXB pgzxb@qq.com

A module whose top-level binding is declared with `var`/`function` and then
re-declared by a namespace import (`import * as name`) is accepted, although
ECMA-262 makes duplicate top-level module binding names an early SyntaxError.
The scanner already records `SCANNER_TYPE_ERR_REDECLARED` for the imported name
and the named-import clause rejects it, but the namespace-import branch of
`parser_parse_import_statement()` never performed that check. The name is then
referenced from the module scope while absent from `module_p->imports_p`, and
during linking `ecma_module_resolve_export()` falls through to
`ecma_module_resolve_import()`. That function walks `imports_p` with an
unbounded `while (true)` loop whose only terminating guard is a `JERRY_ASSERT`
(compiled out in release builds), so it dereferences
`import_node_p->module_names_p` after `import_node_p` has reached NULL.

The namespace-import path now performs the same redeclaration check that
`parser_module_parse_import_clause()` already uses, so the duplicate binding is
rejected as a SyntaxError while the module is parsed. As defence in depth,
`ecma_module_resolve_import()` now stops when it runs out of import nodes and
returns `false` (resolution failure) instead of relying on an assertion; the
caller already handles an unsuccessful resolution.

Fixes jerryscript-project#5292

JerryScript-DCO-1.0-Signed-off-by: PGZXB <pgzxb@qq.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

jerryscript: NULL-pointer dereference in ES-module linker (ecma_module_resolve_import) via duplicate var/namespace-import binding — pre-link crash

1 participant