Type confusion in jsValue.c

[sunlili]

version: jsish 3.5.0
os: ubuntu 20.04

poc:

var V0 = (String ( Number ( "asasa" ) ) !== "NaN");

output:

.../jsish-master/poc.js:1: bug: Ieee function got problem    (at or near "asasa")

When StringConstructor() creates the String object, Jsi_ValueToString() will convert the first argument Number ( "asasa" ) to string type. There is a type confusion bug in Jsi_ValueToString() function.

jsish/src/jsiValue.c

Lines 486 to 542 in 4e5066c

	const char* Jsi_ValueToString(Jsi_Interp *interp, Jsi_Value *v, int *lenPtr)
	{
	Jsi_Number d;
	const char *ntxt = "undefined";
	int kflag = 1;
	int isKey = 0;
	char *key = NULL;
	if (!v)
	goto done;
	if (lenPtr) *lenPtr = 0;
	char unibuf[JSI_MAX_NUMBER_STRING*2];
	switch(v->vt) {
	case JSI_VT_STRING:
	ntxt = v->d.s.str;
	goto done;
	case JSI_VT_UNDEF:
	break;
	case JSI_VT_BOOL:
	ntxt = v->d.val ? "true":"false";
	break;
	case JSI_VT_NULL:
	ntxt = "null";
	break;
	case JSI_VT_NUMBER: {
	d = v->d.num;
	fmtnum:
	if (Jsi_NumberIsInteger(d)) {
	Jsi_NumberItoA10((Jsi_Wide)d, unibuf, sizeof(unibuf));
	kflag = 0;
	ntxt = unibuf;
	} else if (Jsi_NumberIsNormal(d)) {
	Jsi_NumberDtoA(interp, d, unibuf, sizeof(unibuf), 0);
	kflag = 0;
	ntxt = unibuf;
	} else if (Jsi_NumberIsNaN(v->d.num)) {
	ntxt = "NaN";
	} else {
	int s = Jsi_NumberIsInfinity(d);
	if (s > 0) ntxt = "Infinity";
	else if (s < 0) ntxt = "-Infinity";
	else if (!interp->logMsgDepth) Jsi_LogBug("Ieee function got problem");
	}
	break;
	}
	case JSI_VT_OBJECT: {
	Jsi_Obj *obj = v->d.obj;
	switch(obj->ot) {
	case JSI_OT_STRING:
	ntxt = obj->d.s.str;
	goto done;
	case JSI_OT_BOOL:
	ntxt = obj->d.val ? "true":"false";
	break;
	case JSI_OT_NUMBER:
	d = obj->d.num;
	goto fmtnum;
	break;

Number ( "asasa" ) is the variable v in above funtion. Since Number ( "asasa" ) is of Object type, jsish executes the JSI_VT_OBJECT case and goes to fmtnum when it finds v->d.obj->ot is of JSI_OT_NUMBER type. However, in jsiValue.c:520, jsish assumes v is of Number type and accesses v->d.num directly, which causes the type confusion.

ISec Lab.