Crashes in mp_pairheap_delete
Description
The UNIX port of MicroPython crashes in the programs involving asyncio.Event(). I briefly looked upon a similar issue and issue #6868 seems like pointing to a similar crash (found with a static analyzer in 2021). This crash is also exhibited in either global-buffer-overflow or null-dereference. I have attached three PoCs for each bug type below.
Proof of Concept
$ # build unix port with ASAN, at the root source code directory.
$ export CC=clang
$ export CXX=clang++
$ export CFLAGS="-fsanitize=address -fno-omit-frame-pointer"
$ export CXXFLAGS=$CFLAGS
$ export LDFLAGS=$CFLAGS
$ export DEBUG=1
$ make -C mpy-cross -j
$ make -C ports/unix -j all lib
$
$ # run a poc.
$ export ASAN_OPTIONS="detect_leaks=0"
$ ./ports/unix/build-standard/micropython <poc_file>
Environment
Ubuntu 20.04
Intel(R) Xeon(R) Gold 5218 CPU @ 2.30GHz
Memory: 64 GB
Affected Version
v1.20.0 (commit a3862e726, latest as of 2023-09-26)
v1.20.0 (commit 813d559bc, 2023-06-19)
Discovered in the UNIX port version.
Crashes while using builtins.super
Description
The UNIX port of MicroPython crashes while using builtins.super() in one way or another. The crash was exhibited as global-buffer-overflow and null-dereference (SEGV near the null address). Most of the crashes happened in mp_obj_class_lookup, but one crash happened in mp_obj_get_type (the stack trace and PoC look similar to other crashes). We've attached one PoC for global-buffer-overflow, three PoCs for null-dereference, and one PoC for the crash in mp_obj_get_type.
Proof of Concept
$ # build unix port with ASAN, at the root source code directory.
$ export CC=clang
$ export CXX=clang++
$ export CFLAGS="-fsanitize=address -fno-omit-frame-pointer"
$ export CXXFLAGS=$CFLAGS
$ export LDFLAGS=$CFLAGS
$ export DEBUG=1
$ make -C mpy-cross -j
$ make -C ports/unix -j all lib
$
$ # run a poc.
$ export ASAN_OPTIONS="detect_leaks=0"
$ ./ports/unix/build-standard/micropython <poc_file>
Environment
Ubuntu 20.04
Intel(R) Xeon(R) Gold 5218 CPU @ 2.30GHz
Memory: 64 GB
Affected Version
v1.20.0 (commit a3862e726, latest as of 2023-09-26)
v1.20.0 (commit 813d559bc, 2023-06-19)
Discovered in the UNIX port version.