Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2021-41556: Squirrel - The Programming Language

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.

CVE
#ios#android#mac#windows#linux#git#java#c++#pdf

Overview

Squirrel is a high level imperative, object-oriented programming language, designed to be a light-weight scripting language that fits in the size, memory bandwidth, and real-time requirements of applications like video games. Although Squirrel offers a wide range of features like:

  • Open Source MIT licence

  • dynamic typing

  • delegation

  • classes & inheritance

  • higher order functions

  • lexical scoping

  • generators

  • cooperative threads(coroutines)

  • tail recursion

  • exception handling

  • automatic memory management (CPU bursts free; mixed approach ref counting/GC)

  • both compiler and virtual machine fit together in about 7k lines of C++ code and add only around 100kb-150kb the executable size.

  • optional 16bits characters strings

  • powerful embedding api

    • eg. function/classes can be defined by scripts or in C
    • eg. objects can fully exist in the VM or be bound to native code
    • eg. classes created in C can be extended by scripts or vice-versa
    • and more

    Squirrel is inspired by languages like Python,Javascript and especially Lua(The API is very similar and the table code is based on the Lua one)

What Does it look like?  
squirrel's syntax is similar to C/C++/Java etc... but the language has a very dynamic nature like Python/Lua etc...

local table = {
    a = "10"
    subtable = {
        array = \[1,2,3\]
    },
    \[10 + 123\] = "expression index"
}
 
local array=\[ 1, 2, 3, { a = 10, b = "string" } \];
 
foreach (i,val in array)
{
    ::print("the type of val is"+typeof val);
}
 
/////////////////////////////////////////////
 
class Entity
{   
    constructor(etype,entityname)
    {
        name = entityname;
        type = etype;
    }
                                    
    x = 0;
    y = 0;
    z = 0;
    name = null;
    type = null;
}
 
function Entity::MoveTo(newx,newy,newz)
{
    x = newx;
    y = newy;
    z = newz;
}
 
class Player extends Entity {
    constructor(entityname)
    {
        base.constructor("Player",entityname)
    }
    function DoDomething()
    {
        ::print("something");
    }
    
}
 
local newplayer = Player("da playar");
 
newplayer.MoveTo(100,200,300);          

  
Development state  

The current stable release is 3.2  
The project has been compiled and run on Windows(x86 & x64), Linux(x86 & x64), Illumos(x86 & x64), Mac OS X, FreeBSD, iOS and Android.  
Has been tested with the following compilers:

> MS Visual C++ 6.0,7.0,7.1,8.0,9.0 and 10.0(x86 & x64)  
> MinGW gcc 3.2 (mingw special 20020817-1)  
> Cygwin gcc 3.2  
> Linux gcc 3.x  
> Linux gcc 4.x  
> Illumos gcc 4.x  
> XCode 4  

The documentation has to be improved.  

I'd like to have some feed back and maybe help to design/port/test it.

  
Work in Progress

In the next release(3.2.x stable):

*   more compact bytecode
*   performance tuning
*   additional documentation

  
Documentation  
**Squirrel 3.2**

Online Squirrel 3.2 reference manual and Standard Libraries manual)

Offline Squirrel 3.2 Reference Manual (PDF)  
Offline Squirrel 3.2 Standard Libraries Manual (PDF)

both manuals are included in the language distribution

  
**Squirrel 3.0.x**

Squirrel 3.0 reference manual(PDF/HtmlHelp/Html Online)

Squirrel 3.0 Standard Libraries manual(PDF/HtmlHelp/Html Online)

both manuals are included in the language distribution

  
**Squirrel 2.x**

Squirrel 2.0 reference manual(PDF/HtmlHelp/Html Online)

Squirrel 2.0 Standard Libraries manual(PDF/HtmlHelp/Html Online)

both manuals are included in the language distribution

  
Download  
**stable release**

You can download Squirrel 3.2 stable here  
_Released February 10, 2022._

**GitHub Repository**

Squirrel's GitHub repository is here

**older 3.x release**

You can download Squirrel 3.0.7 stable here  
_Released January 10, 2015._

**older 2.x stable release**

You can download Squirrel 2.2.5 stable here  
_Released November 28, 2011._

My name is Alberto Demichelis if you want to know more about me, this is my personal homepage

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda