NULL dereference in gravity_vm_loadbuffer() with malformed JSON executable input

[damseleng]

Summary

I found a second, separate crash in Gravity.

This is separate from the optimizer constant-folding FPE I reported earlier. This issue affects the JSON executable loading path used by gravity -x / gravity_vm_loadbuffer().

A malformed JSON executable input with a function object that is missing the expected identifier can cause a NULL pointer dereference.

Affected versions tested

I confirmed the issue on a clean checkout.

latest master:
  affected

latest release 0.9.7:
  affected

Reproducer

PoC input:

{"x":{"type":"function"}}

Save it as:

loadbuffer_missing_identifier_min.json

Run:

./gravity -x loadbuffer_missing_identifier_min.json

Observed result

In a non-ASan build, the process crashes with a segmentation fault:

exit code: 139

In an ASan build, the crash is reported as a SEGV in the following path:

strlen
gravity_vm_loadbuffer

Expected result

Malformed JSON executable input should be rejected as a parse/load error instead of crashing.

Root cause

The JSON executable loader appears to assume that a function object contains an identifier/name field before passing it to string handling code. When that field is missing, a NULL pointer is eventually passed to strlen() through the gravity_vm_loadbuffer() path.

Suggested fix direction

The loader should validate required fields for function objects before using them. If the identifier/name is missing or not a string, gravity_vm_loadbuffer() should reject the JSON executable input and return an error.

I tested a local fix in src/runtime/gravity_vm.c that makes the minimized PoC fail cleanly as a JSON executable parse error instead of crashing.

Reproduction package

I have a reproduction package containing the minimized PoC, ASan/non-ASan logs, report, and suggested fix diff:

submission_gravity_loadbuffer_missing_identifier.zip
SHA-256: E8FA77D606A499AAD4F978DA304AA889D09365E9290B0D3214FE3EA64

I can provide it if useful.