CVE-2017-9250: NULL Pointer Dereference (CWE-476)
value: The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2017-05-28T20:29Z
Repository: https://github.com/jerryscript-project/jerryscript
Language: JavaScript
Files changed: jerry-core/parser/js/js-lexer.c, tests/jerry/regression-test-issue-1833.js
Commit date: 2017-05-22 13:17:08 +0200
Commit message: Do not allocate memory for zero length strings. (#1844)

Fixes #1821.

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com
Diff: diff --git a/jerry-core/parser/js/js-lexer.c b/jerry-core/parser/js/js-lexer.c
index 71db7e62..f7bd5b95 100644
--- a/jerry-core/parser/js/js-lexer.c
+++ b/jerry-core/parser/js/js-lexer.c
@@ -1195,10 +1195,15 @@ lexer_process_char_literal (parser_context_t *context_p, /**< context */
   if (literal_index >= PARSER_MAXIMUM_NUMBER_OF_LITERALS)
   {
     parser_raise_error (context_p, PARSER_ERR_LITERAL_LIMIT_REACHED);
   }
 
+  if (length == 0)
+  {
+    has_escape = false;
+  }
+
   literal_p = (lexer_literal_t *) parser_list_append (context_p, &context_p->literal_pool);
   literal_p->prop.length = (uint16_t) length;
   literal_p->type = literal_type;
   literal_p->status_flags = has_escape ? 0 : LEXER_FLAG_SOURCE_PTR;
 
diff --git a/tests/jerry/regression-test-issue-1833.js b/tests/jerry/regression-test-issue-1833.js
new file mode 100644
index 00000000..7c086016
--- /dev/null
+++ b/tests/jerry/regression-test-issue-1833.js
@@ -0,0 +1,16 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+'\
+'

Fixed code:   if (length == 0)
  {
    has_escape = false;
  }

// Copyright JS Foundation and other contributors, http://js.foundation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

'\
'