stack-overflow ./jsish/src/jsiValue.c:1451 in IterGetKeysCallback

[Ye0nny]

Jsish revision

Commit: 42c694c
Version: v3.5.0

Build platform

Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

Build steps

export JSI__SANITIZE=1
make

Test case

testcase

var a = { length : 3 } ; 
a. length = 10 ; 
a. foo = [ ] ; 
a [ 0 ] = " bar " ; 
[ " bar " ] ;
a [ 3 ] = null ; 
Object. setPrototypeOf ( Object. getPrototypeOf ( a ), Array. prototype ) ; 
Object. setPrototypeOf ( a, String. prototype ) ; 
var r ; 
Object. keys ( a ) ; 
var t = Object. keys ( a ). length ; 
var l = 1 ; 
r = " vieraıra " + l + " straır ". substring ( - 50 ) ; 
r [ 2 ] = r [ 2 ] ( 0, 15 ) ; 
r [ 2 ] = r [ 2 ] ; 
r [ 0 ] = r [ 0 ] + 1 ; 
String ( r [ 3 ] ) && r [ 0 ] > l ; 
l = null ; 
l = l == null ; 
l = l || Boolean ( " " ) ; 
l ;

// poc.js
var a = { } ;
Object. setPrototypeOf ( Object. getPrototypeOf ( a ), Array. prototype ) ;
Object. keys ( a ) ;

Execution steps & Output

$ ./jsish/jsish poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2355298==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd839b9ff8 (pc 0x000000506531 bp 0x000000000000 sp 0x7ffd839ba000 T0)
    #0 0x506531 in IterGetKeysCallback ./jsish/src/jsiValue.c:1451
    #1 0x617d46 in tree_inorder ./jsish/src/jsiTree.c:836:9
    #2 0x617cbf in tree_inorder ./jsish/src/jsiTree.c:833:13
    #3 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #4 0x617cbf in tree_inorder ./jsish/src/jsiTree.c:833:13
    #5 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #6 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #7 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #8 0x61710f in Jsi_TreeWalk ./jsish/src/jsiTree.c:914:16
    #9 0x4ff066 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1496:5
    #10 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #11 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #12 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #13 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    ....
    #244 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #245 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #246 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #247 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #248 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9

SUMMARY: AddressSanitizer: stack-overflow ./jsish/src/jsiValue.c:1451 in IterGetKeysCallback
==2355298==ABORTING

---

when executed in release mode

Outputs

Segmentation fault

Credits: @Ye0nny, @EJueon of the seclab-yonsei.