jerryscript-ext/arg.impl.h@106 has an out-of-bounds read

[mlite]

The same reproducing steps like the previous issues with Stensal SDK (https://stensal.com)
Feel free to reach out to me if you need help to interprete the error message.

DTS_MSG: Stensal DTS detected a fatal program error!
DTS_MSG: Continuing the execution will cause unexpected behaviors, abort!
DTS_MSG: OOB Read:reading 4 bytes at 0xfffe15ac will read undefined values.
DTS_MSG: Diagnostic information:

• The object to-be-read (start:0xfffe15ac, size:2 bytes) is allocated at

• file:/home/sbuilder/workspace/jerryscript/jerry-ext/include/jerryscript-ext/arg.impl.h::106, 1
  

• 0xfffe15ac 0xfffe15ad
• +------------------------+
• | the object to-be-read |......
• +------------------------+
• ^~~~~~~~~~
• the read starts at the object begin.
• Stack trace (most recent call first):
  -[1] file:/home/sbuilder/workspace/jerryscript/jerry-ext/include/jerryscript-ext/arg.impl.h::106, 1
  -[2] file:/home/sbuilder/workspace/jerryscript/tests/unit-ext/test-ext-arg.c::384, 5
  -[3] file:/home/sbuilder/workspace/jerryscript/jerry-core/ecma/operations/ecma-function-object.c::744, 32
  -[4] file:/home/sbuilder/workspace/jerryscript/jerry-core/vm/vm.c::534, 24
  -[5] file:/home/sbuilder/workspace/jerryscript/jerry-core/vm/vm.c::3467, 9
  -[6] file:/home/sbuilder/workspace/jerryscript/jerry-core/vm/vm.c::3564, 10
  -[7] file:/home/sbuilder/workspace/jerryscript/jerry-core/vm/vm.c::235, 10
  -[8] file:/home/sbuilder/workspace/jerryscript/jerry-core/api/jerry.c::544, 24
  -[9] file:/home/sbuilder/workspace/jerryscript/tests/unit-ext/test-ext-arg.c::830, 23
  -[10] file:/home/nwang/acore/musl/src/env/__libc_start_main.c::180, 11

[akosthekiss]

@mlite Thanks for the report. This may be an actual OOB read in jerry-ext.

The problem is in jerry-ext/include/jerryscript-ext/arg.impl.h around lines 97-103:

    const jerryx_arg_int_option_t int_option = { .round = (uint8_t) round_flag, .clamp = (uint8_t) clamp_flag }; \
    return (jerryx_arg_t) \
    { \
      .func = func, \
      .dest = (void *) dest, \
      .extra_info = *(uintptr_t *) &int_option \ /// BUG: int_option may be of 2 bytes only (arch/os/compiler-dependent) but it is always read as an integer of size that can store a pointer (usually 4 or 8 bytes)
    }; \

Note: other initializations of .extra_info may also need a review.