#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "wren.h"
void writeFn(WrenVM* vm, const char* text) {
}
void errorFn(WrenVM* vm, WrenErrorType type, const char* module, int line, const char* message) {
}
int main(int argc, char** argv) {
if (argc < 2) return 1;
FILE* f = fopen(argv[1], "rb");
if (!f) return 1;
fseek(f, 0, SEEK_END);
long length = ftell(f);
fseek(f, 0, SEEK_SET);
char* buffer = (char*)malloc(length + 1);
if (!buffer) {
fclose(f);
return 1;
}
if (fread(buffer, 1, length, f) != (size_t)length) {
free(buffer);
fclose(f);
return 1;
}
buffer[length] = '\0';
fclose(f);
WrenConfiguration config;
wrenInitConfiguration(&config);
config.writeFn = writeFn;
config.errorFn = errorFn;
WrenVM* vm = wrenNewVM(&config);
WrenInterpretResult result = wrenInterpret(vm, "main", buffer);
wrenFreeVM(vm);
free(buffer);
return 0;
}
Description
We discovered a Segmentation Fault in the Wren compiler. The crash occurs in getByteCountForArguments when compiling a specifically crafted script containing for loops (likely nested or within a class method).
The ASAN report indicates a SEGV on address 0x0000000005c8. Given the small offset from zero, this is almost certainly a NULL Pointer Dereference where a struct member is accessed from a NULL pointer.
Environment
Vulnerability Details
In endLoop, the compiler generates bytecode for the iterator protocol. It likely attempts to access signature information or compiler state to determine argument byte counts for the implicit iterate or iteratorValue calls. If the compilation state is corrupted (e.g., inside a malformed class definition or deeply nested structure), a required pointer (likely the Compiler* or a Signature*) is NULL, causing the crash.
Reproduce
harness.c
ASAN report