Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

segment fault 6 #6648

Open
bird8693 opened this issue Mar 17, 2021 · 0 comments
Open

segment fault 6 #6648

bird8693 opened this issue Mar 17, 2021 · 0 comments

Comments

@bird8693
Copy link

enviroment

ubuntu 16

poc

function main() {
    var HWyR = 268435456 <= 9007199254740991;
    let arr = [
        1.1,
        2.2,
        3.3
    ];
    for (let i = 0; i < 65536; i++) {
        opt();
    }
    Array.prototype.__defineGetter__('x', Object.prototype.valueOf);
    var aKGJ = Symbol;
    print(opt());
}
var r = new Object();
var r = new Object();
for (var ijjkkk = 0; ijjkkk < 100000; ++ijjkkk) {
    var nrYB = Symbol;
}
let arr = [];
var CollectGarbage = new Object();
var r = new Object();
var Mchh = vars >= r;
var vars = [];
var r = new Object();
JSON.parse(null);
once = CollectGarbage != 1.3;
var ThnA = +9007199254740994;
var PHrh = -9007199254740991;
once = true;
var Jknd = Date;
var r = new Object();
var YQZc = +0.1;
var CollectGarbage = new Object();
for (var Rjsi = new Uint32Array([1200]); i < 20000; i++) {
    vars[-1] = 'aaaaa';
}
var r = new Object();
r.lastIndex = 'aaaaa';
once = CollectGarbage != 1.3;
r.lastIndex = 'aaaaa';
for (var i = 20000; i < 40000; i++) {
    vars[vars.length] = 'aaaaa';
    var xxKn = 3.141592653589793 * 1e-81;
    for (var i = 20000; i < 40000; i++) {
        vars[i] = ' \'\' ';
        var JfHf = CollectGarbage ** r + 1073741825;
        vars = !NaN;
        Array.prototype.length = 0;
    }
    for (var i = 20000; i < 40000; i++) {
        for (var ijjkkk = 0; ijjkkk < 100000; ++ijjkkk) {
            var Jknd = Date;
        }
        once = Mchh.valueOf();
        var HWyR = 268435456 <= 9007199254740991;
        var dmdd = CollectGarbage % 1200;
        var dmdd = CollectGarbage % 1200;
        vars[-1] = 'aaaaa';
        var CollectGarbage = new Object();
        var SSsr = 2147483649 + -4294967297;
        var Rjsi = new Uint32Array([1200]);
        once = Mchh.valueOf();
        var cJjF = delete NaN;
        var nmMt = new Set([3.141592653589793]);
        var chhy = new RegExp(null);
        var dmdd = CollectGarbage % 1200;
        var RjjJ = -1;
        once = CollectGarbage != 1.3;
        var winE = Promise;
    }
    var dmdd = CollectGarbage % 1200;
    vars[-1] = 'aaaaa';
    once = Mchh.valueOf();
    vars[vars.length] = 'aaaaa';
    var r = new Object();
    var nmMt = new Set([3.141592653589793]);
    var Mchh = vars >= r;
}
var dmdd = CollectGarbage % 1200;
var sRcZ = Proxy;

output

command line output

Segmentation fault (core dumped)

gef output

─────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
   0x7ff7f2f932d0                  push   0x48ca8b48
   0x7ff7f2f932d5                  shr    ecx, 0x30
   0x7ff7f2f932d8                  jne    0x7ff7f2f93cc3
 → 0x7ff7f2f932de                  mov    rcx, QWORD PTR [rdx+0x8]
   0x7ff7f2f932e2                  xor    edi, edi
   0x7ff7f2f932e4                  cmp    rcx, QWORD PTR [r13+0x480]
   0x7ff7f2f932eb                  jne    0x7ff7f2f93cdf
   0x7ff7f2f932f1                  cmovne rdx, rdi
   0x7ff7f2f932f5                  mov    rdi, QWORD PTR [r15+0x4d0dc]
─────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "ch", stopped 0x7ff7f2f932de in ?? (), reason: SIGSEGV
[#1] Id 2, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#2] Id 3, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#3] Id 4, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
───────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x7ff7f2f932de → mov rcx, QWORD PTR [rdx+0x8]

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant