Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Done
Priority: P2: Important
Fix Version/s: 5.12.3, 5.13.1, 5.14.0 Alpha
Affects Version/s: 5.12.1
Component/s: QML: Declarative and Javascript Engine
Labels:
- found_by_libfuzzer
Environment:
Manjaro Linux
clang 7.0.1
gcc 8.2.1

Commits:
cdb8eb988e572411030486ad2834ae54e4567bf3 (qt/qtdeclarative/5.12)

Description

Have a simple program running QJSEngine::evaluate (evaluate-cli.zip).

#include <QCoreApplication>
#include <QFile>
#include <QJSEngine>

int main(int argc, char *argv[])
{
    QCoreApplication a(argc, argv);
    if (argc < 2)
        return -1;
    QFile inFile(argv[1]);
    inFile.open(QFile::ReadOnly);
    QJSEngine().evaluate(inFile.readAll());
    return 0;
}

Build it on Qt 5.12.1.

Run the program passing the attached input file as parameter: [...[],[,,$]]
The program crashes:

1  raise                                                   0x7ffff6dc6d7f 
2  abort                                                   0x7ffff6db1672 
3  qt_message_fatal                   qlogging.cpp    1901 0x7ffff7378a14 
4  QMessageLogger::fatal              qlogging.cpp    887  0x7ffff737965f 
5  qt_assert                          qlogging.h      91   0x7ffff7371f82 
6  QV4::Runtime::method_iteratorClose qv4heap_p.h     82   0x7ffff7d03c00 
7  QV4::Moth::VME::interpret          qv4vme_moth.cpp 911  0x7ffff7c7eb9e 
8  QV4::Moth::VME::exec               qv4vme_moth.cpp 441  0x7ffff7c84003 
9  QV4::Function::call                qv4function.cpp 68   0x7ffff7beec19 
10 QV4::Script::run                   qv4script.cpp   160  0x7ffff7c4d501 
11 QJSEngine::evaluate                qjsengine.cpp   527  0x7ffff7bac526 
12 main                               main.cpp        12   0x55555555533a