search

gfwilliams / tiny-js

Automatically exported from code.google.com/p/tiny-js
MIT License
532 stars 88 forks source link

Division Exception #34

Open bird8693 opened 4 years ago

bird8693 commented 4 years ago

Enviroment

operating system: ubuntu18.04
compile command: make
test command: ./run_tests  poc

poc:

https://drive.google.com/open?id=1pQIgme3iIyP2Z115HOoDSFD8dm5YneyY

vulnerability description:

There is a problem with CScriptVar :: mathsOp. On the TinyJS.cpp + 1060 line, a floating point arithmetic error is triggered, as shown in the figure: image The reason for the vulnerability is that during the calculation of the remainder operation, the division is actually calculated, but if the dividend is 0, the division floating point number is wrong.

PoC construction

In the process of declaring variables, 0 is used as the remainder.

image

false is actually 0.