Skip to content

Fix out-of-bounds write in the jerry-snapshot literals-list parser - #5314

Open
PGZXB wants to merge 1 commit into
jerryscript-project:masterfrom
PGZXB:fix-issue-5293
Open

PGZXB wants to merge 1 commit into
jerryscript-project:masterfrom
PGZXB:fix-issue-5293

Conversation

@PGZXB

@PGZXB PGZXB commented Sep 25, 2026

Copy link
Copy Markdown

process_generate() in the jerry-snapshot tool reads the literal entries of a
--load-literals-list-format file into two fixed-size globals,
magic_string_items[JERRY_LITERAL_LENGTH] and
magic_string_lengths[JERRY_LITERAL_LENGTH] (JERRY_LITERAL_LENGTH is 4096).
The parse loop increments num_of_lit for every entry with a positive size but
never checks it against the array capacity, so the 4097th entry writes
magic_string_items[4096] and magic_string_lengths[4096] past the end of both
arrays:

if (mstr_size > 0)
{
  magic_string_items[num_of_lit] = (jerry_char_t *) (sp_buffer_end_p + 1); /* OOB at num_of_lit == 4096 */
  magic_string_lengths[num_of_lit] = mstr_size;
  num_of_lit++;
}

This is a global out-of-bounds write of an 8-byte pointer plus a
fully-controlled 4-byte value into the adjacent globals. A literals-list with
4097 entries and a one-line script is enough to trigger it:

$ python3 -c "open('lits.list','w').write('1 a\n'*4097)"
$ printf 'var a=1;\n' > src.js
$ jerry-snapshot generate --load-literals-list-format lits.list src.js -o out.snapshot
ERROR: AddressSanitizer: global-buffer-overflow ... WRITE of size 8
    #0 process_generate jerry-main/main-snapshot.c:323
0x... is located 0 bytes after global variable 'magic_string_items'
    defined in 'jerry-main/main-snapshot.c:47' ... of size 32768
SUMMARY: AddressSanitizer: global-buffer-overflow in process_generate

The parser now rejects a list that would exceed the fixed capacity: when
num_of_lit has reached JERRY_LITERAL_LENGTH it logs the error, cleans up and
returns a failure exit code instead of writing past the arrays.

Verification with the documented --jerry-cmdline-snapshot=on build:

  • before: SUMMARY: AddressSanitizer: global-buffer-overflow ... in process_generate (exit 1)
  • after, 4097 entries: Error: Too many literals in the list (maximum: 4096), no sanitizer report
  • after, exactly 4096 entries: Created snapshot file: 'o4096.snapshot' (70 bytes), exit 0

Fixes #5293

JerryScript-DCO-1.0-Signed-off-by: PGZXB pgzxb@qq.com

process_generate() reads the entries of a --load-literals-list-format file into
the fixed-size globals magic_string_items[JERRY_LITERAL_LENGTH] and
magic_string_lengths[JERRY_LITERAL_LENGTH] (4096 entries). The parse loop
increments num_of_lit without bounding it against the array capacity, so the
4097th entry writes past the end of both arrays. Reject a literals-list that
would exceed JERRY_LITERAL_LENGTH before writing the entry.

Fixes jerryscript-project#5293

JerryScript-DCO-1.0-Signed-off-by: PGZXB <pgzxb@qq.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

jerryscript jerry-snapshot tool: unbounded literals-list parser → global-buffer-overflow (OOB write) in process_generate

1 participant