Project: njs (nginx/njs), language: c++
Vulnerability instance: njs.cve-2021-46461
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/nginx/njs/issues/450
## Description:
Issue: nginx/njs#450
Title: illegal memcpy during njs_vmcode_typeof in /njs/src/njs_vmcode.c:1521:18
State: closed
Created by: anonym0us1337
Created at: 2021-12-24 06:33:59+00:00
Labels: bug, fuzzer

Issue Body:
## Env
```
Version    : 0.7.0
Git Commit : 2da5d8b246b806bee6f74b575217ec3b61a25548
OS         : Ubuntu 20.04
Configure  : ./configure --address-sanitizer=YES
```
## POC
```
function main() {
    const v2 = new ArrayBuffer();
    const v3 = new DataView(v2);
    const v5 = typeof v3;
}
main();
```
## Stack Dump
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==466645==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe5fea5cc5b bp 0x7ffe64718cb0 sp 0x7ffe64718468 T0)
==466645==The signal is caused by a READ memory access.
==466645==Hint: address points to the zero page.
    #0 0x7fe5fea5cc5b in memcpy /build/glibc-eX1tMB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:142
    #1 0x495737 in __asan_memcpy (/home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/build/njs+0x495737)
    #2 0x4e54bf in njs_vmcode_typeof /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:1521:18
    #3 0x4e54bf in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:594:23
    #4 0x53ae40 in njs_function_lambda_call /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_function.c:701:11
    #5 0x4e4648 in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:783:23
    #6 0x4dea17 in njs_vm_start /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vm.c:493:11
    #7 0x4c7f3d in njs_process_script /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:881:19
    #8 0x4c7375 in njs_process_file /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:615:11
    #9 0x4c7375 in main /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:315:15
    #10 0x7fe5fe9c50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x41dabd in _start (/home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/build/njs+0x41dabd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /build/glibc-eX1tMB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:142 in memcpy
==466645==ABORTING
```
## Credit
P1umer, afang5472, Kotori of NeSE@IIE


Comments:
Comment by drsm on 2021-12-24 07:02:49+00:00:
Hi!
@anonym0us1337 

Thank you for report.

Here is the patch:
```diff
# HG changeset patch
# User Artem S. Povalyukhin <artem.povaluhin@gmail.com>
# Date 1640329215 -10800
#      Fri Dec 24 10:00:15 2021 +0300
# Node ID 53b292346e7f63c3ea952ab08aa8619d955a8bc2
# Parent  4d4657128baffb8eb6b6958c436075387b57530f
Fixed null pointer dereference in njs_vmcode_typeof.

diff -r 4d4657128baf -r 53b292346e7f src/njs_vmcode.c
--- a/src/njs_vmcode.c  Tue Dec 21 17:42:26 2021 +0000
+++ b/src/njs_vmcode.c  Fri Dec 24 10:00:15 2021 +0300
@@ -1516,6 +1516,7 @@ njs_vmcode_typeof(njs_vm_t *vm, njs_valu
         &njs_string_object,
         &njs_string_object,
         &njs_string_object,
+        &njs_string_object,
     };
 
     vm->retval = *types[value->type];
diff -r 4d4657128baf -r 53b292346e7f src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c  Tue Dec 21 17:42:26 2021 +0000
+++ b/src/test/njs_unit_test.c  Fri Dec 24 10:00:15 2021 +0300
@@ -6390,6 +6390,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("(new DataView(new ArrayBuffer(3)))"),
       njs_str("[object DataView]") },
 
+    { njs_str("var x = new ArrayBuffer(3); [typeof x, typeof new DataView(x)]"),
+      njs_str("object,object") },
+
     { njs_str("(new DataView(new ArrayBuffer(3))).buffer"),
       njs_str("[object ArrayBuffer]") },
 
```

---

Comment by P1umer on 2022-02-15 20:32:18+00:00:
This issue was assigned [CVE-2021-46461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46461).

Commit References:
4d4657128baffb8eb6b6958c436075387b57530f
53b292346e7f63c3ea952ab08aa8619d955a8bc2
2da5d8b246b806bee6f74b575217ec3b61a25548

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./autogen.sh
CFLAGS="$CFLAGS -fno-use-cxa-atexit" CXXFLAGS="$CXXFLAGS -fno-use-cxa-atexit" ./configure
make -j$(nproc) clean
make -j$(nproc) all
make install -j$(nproc)
sed -i "s/\$libS\$libR \(-lpcre2-8$\)/\$libS\$libR -Wl,-Bstatic \1 -Wl,-Bdynamic/" /usr/local/bin/pcre2-config
./configure
make njs_fuzzer -j$(nproc)
mkdir -p $SEED_CORPUS_PATH

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool mercurial git libpcre2-dev
RUN git clone https://github.com/nginx/njs njs
RUN git -C njs checkout 61c91f55b925083246157ded44d54583025d115e
WORKDIR $SRC/njs
COPY build.sh $SRC/

Additional files: