Gravity v0.9.8 Security Update: Bytecode Loader, Compiler & Runtime Memory Bugs via Fuzzing

Gravity v0.9.8 Security Update Summary Vulnerability Overview This is a security and memory-safety release. It primarily fixes multiple crash issues discovered by external researchers through fuzz testing of the compiler and bytecode loader, and adds regression tests. Scope of Impact Bytecode Loader: Triggerable by attacker-controlled serialized files, including null pointer dereferencing, signed 64-bit integer overflow, and out-of-bounds pointer arithmetic. Compiler: Out-of-bounds reads in , division-by-zero/undefined behavior in floating-point remainder calculation, and line number corruption in CR-LF line-ending handling. Runtime: Heap buffer overflow in . Windows Platform: Code paths are guarded by and macros. The Visual Studio project defined in exactly 2 out of 12 configurations, causing x64 builds to compile the POSIX code body. Memory Lifecycle: Unreleased optional class instances, core reference leaks, and double-free of inline source code buffers. Fix Details Fixed all listed memory safety and logic defects. Added a build target, which is identical to but includes the C entry points required by the library project. Added : Fuzz testing for malicious JSON executable files, with 60 checks directly driving the JSON scanner. Added the and test scripts. Added a GitHub Actions workflow that builds using gcc and clang on Linux and macOS, running unit tests, fuzz tests, and loader tests with . Updated the and documentation, corrected the default output format of in , and removed the dependency on the workflow. POC / Exploit Code The page does not include a standalone POC or exploit code block, but mentions the following key tests and reproduction paths: : Fuzz testing entry point. : Unit test runner script. : Regression test for the CR-LF line-ending issue. Fuzz testing is executed with , running 353/353 unit tests and 12/12 loader tests, and processing a fuzz corpus of 742 inputs.

Goal Reached Thanks to every supporter — we hit 100%!

Gravity v0.9.8 Security Update: Bytecode Loader, Compiler & Runtime Memory Bugs via Fuzzing

More from this source