Illegal memory dereference in isFiniteCmd

[pcmacdon]

DongzhuoZhao added on 2020-05-11 03:55:46:
git version:
4603977

save follow testcase as .js format :

var v1 = new Array((()=>"toString")(), []);
v1.find(isFinite);

run:
./jsimin poc.js

Result:
zdz@ubuntu:~/jsish$ ./jsimin /home/zdz/debugBug/jsi/bug/poc.js
Segmentation fault (core dumped)

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0000555555591d03 in Jsi_ValueIsNumber (interp=0x555555865260, pv=0x0)
at ./src/jsiValue.c:456
456 return (pv->vt == JSI_VT_NUMBER || (pv->vt == JSI_VT_OBJECT && pv->d.obj->ot == JSI_OT_NUMBER));
(gdb) bt
#0 0x0000555555591d03 in Jsi_ValueIsNumber (interp=0x555555865260, pv=0x0)
at ./src/jsiValue.c:456
#1 0x00005555555cfd3e in isFiniteCmd (interp=0x555555865260,
args=0x5555558c74f0, _this=0x5555558c7530, ret=0x7fffffff59e8,
funcPtr=0x55555588b110) at ./src/jsiCmds.c:1094
#2 0x000055555558f81a in jsi_FunctionInvoke (interp=0x555555865260,
tocall=0x5555558c6d40, args=0x5555558c74f0, ret=0x7fffffff59e8,
_this=0x5555558c73e0) at ./src/jsiFunc.c:799
#3 0x000055555558f9b8 in Jsi_FunctionInvoke (interp=0x555555865260,
func=0x5555558c6d40, args=0x5555558c74f0, ret=0x7fffffff59e8,
_this=0x5555558c73e0) at ./src/jsiFunc.c:823
#4 0x00005555555bc062 in jsi_ArrayFindSubCmd (interp=0x555555865260,
args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0,
funcPtr=0x55555587e2c0, op=1) at ./src/jsiArray.c:584
#5 0x00005555555bc5dc in jsi_ArrayFindCmd (interp=0x555555865260,
args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0,
funcPtr=0x55555587e2c0) at ./src/jsiArray.c:659
#6 0x0000555555616285 in jsi_FunctionSubCall (interp=0x555555865260,
args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0,
tocall=0x5555558c1340, discard=1) at ./src/jsiEval.c:857
#7 0x0000555555616767 in jsiEvalFunction (ps=0x5555558c09d0,
ip=0x5555558c25b0, discard=1) at ./src/jsiEval.c:918

[pcmacdon]

Fixed in Release "3.0.11"

[vulsReport]

Found by Dongzhuo Zhao working with ADLab of Venustech