CVE-2023-48183: Insufficient Information (NVD-CWE-noinfo)
value: QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-23T07:15Z
Repository: https://github.com/bellard/quickjs
Language: C
Files changed: quickjs.c
Commit date: 2023-12-09 12:27:39 +0100
Commit message: fixed lexical scope of 'this' with eval (github issue #192)

Diff: diff --git a/quickjs.c b/quickjs.c
index 35211d6..efe78e8 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -29991,37 +29991,38 @@ static void add_eval_variables(JSContext *ctx, JSFunctionDef *s)
             scope_idx = vd->scope_next;
         }
         is_arg_scope = (scope_idx == ARG_SCOPE_END);
         if (!is_arg_scope) {
             /* add unscoped variables */
+            /* XXX: propagate is_const and var_kind too ? */
             for(i = 0; i < fd->arg_count; i++) {
                 vd = &fd->args[i];
                 if (vd->var_name != JS_ATOM_NULL) {
                     get_closure_var(ctx, s, fd,
-                                    TRUE, i, vd->var_name, FALSE, FALSE,
-                                    JS_VAR_NORMAL);
+                                    TRUE, i, vd->var_name, FALSE,
+                                    vd->is_lexical, JS_VAR_NORMAL);
                 }
             }
             for(i = 0; i < fd->var_count; i++) {
                 vd = &fd->vars[i];
                 /* do not close top level last result */
                 if (vd->scope_level == 0 &&
                     vd->var_name != JS_ATOM__ret_ &&
                     vd->var_name != JS_ATOM_NULL) {
                     get_closure_var(ctx, s, fd,
-                                    FALSE, i, vd->var_name, FALSE, FALSE,
-                                    JS_VAR_NORMAL);
+                                    FALSE, i, vd->var_name, FALSE,
+                                    vd->is_lexical, JS_VAR_NORMAL);
                 }
             }
         } else {
             for(i = 0; i < fd->var_count; i++) {
                 vd = &fd->vars[i];
                 /* do not close top level last result */
                 if (vd->scope_level == 0 && is_var_in_arg_scope(vd)) {
                     get_closure_var(ctx, s, fd,
-                                    FALSE, i, vd->var_name, FALSE, FALSE,
-                                    JS_VAR_NORMAL);
+                                    FALSE, i, vd->var_name, FALSE,
+                                    vd->is_lexical, JS_VAR_NORMAL);
                 }
             }
         }
         if (fd->is_eval) {
             int idx;

Vulnerable code:                                     TRUE, i, vd->var_name, FALSE, FALSE,
                                    JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE, FALSE,
                                    JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE, FALSE,
                                    JS_VAR_NORMAL);
Fixed code:             /* XXX: propagate is_const and var_kind too ? */
                                    TRUE, i, vd->var_name, FALSE,
                                    vd->is_lexical, JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE,
                                    vd->is_lexical, JS_VAR_NORMAL);
                                    FALSE, i, vd->var_name, FALSE,
                                    vd->is_lexical, JS_VAR_NORMAL);