CVE-2020-22874 (C, published 2021-07-13T15:15Z)
Description: value: Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/pcmacdon/jsish
Files changed:
md/Reference.md
src/jsi.h
src/jsiArray.c
src/jsiCData.c
src/jsiInt.h
src/jsiInterp.c
src/jsiObj.c
src/jsiValue.c
tools/protos.jsi
www/reference.wiki
Commit message: Release "3.0.8": Address Array alloc sizing issues from issue "integer overflow and buffer overflow #5".

FossilOrigin-Name: 8c46a1d465b358110dcfb271721d35fe843a1b52f2fa24ccc10094eb8aaf6fe4

Vulnerable code:
<tr><td>maxArrayList</td><td><i>INT</i></td><td>Maximum array convertable to list (100000).</td><td><i></i></td></tr>
#define JSI_VERSION_RELEASE 7
        if ((++n + clen)>interp->maxArrayList)
            if (sf->arrSize>MAX_ARRAY_LIST) {
                rc = Jsi_LogError("array size too big: %d >= %d", sf->arrSize, MAX_ARRAY_LIST);
    int maxArrayList;
    JSI_OPT(INT,   Jsi_Interp, maxArrayList,.help="Maximum array convertable to list (100000)", .flags=JSI_OPT_LOCKSAFE),
    interp->maxArrayList = MAX_ARRAY_LIST;
        if (n<0 || n >= interp->maxArrayList)
    int nsiz = len + 1, mod = ALLOC_MOD_SIZE;
    if (nsiz > MAX_ARRAY_LIST) {
        Jsi_LogError("array size too large");
    if (arrayindex >= 0 && arrayindex < MAX_ARRAY_LIST &&
        if (key >= 0 && key < interp->maxArrayList) {
//JSI Command Prototypes: version 3.0.6
<tr><td>maxArrayList</td><td><i>INT</i></td><td>Maximum array convertable to list (100000).</td><td><i></i></td></tr>

Fixed code:
<tr><td>maxArrayList</td><td><i>UINT</i></td><td>Maximum array convertable to list (100000).</td><td><i></i></td></tr>
#define JSI_VERSION_RELEASE 8
        if ((uint)(++n + clen)>interp->maxArrayList)
            if (sf->arrSize>interp->maxArrayList) {
                rc = Jsi_LogError("array size too big: %d >= %d", sf->arrSize, interp->maxArrayList);
    uint maxArrayList;
    JSI_OPT(UINT,  Jsi_Interp, maxArrayList,.help="Maximum array convertable to list (100000)", .flags=JSI_OPT_LOCKSAFE),
    interp->maxArrayList = MAX_ARRAY_LIST;
        if (n<0 || (uint)n >= interp->maxArrayList)
    uint nsiz = len + 1, mod = ALLOC_MOD_SIZE;
    if (len >= interp->maxArrayList || nsiz > interp->maxArrayList) {
        Jsi_LogError("array size too big: %u >= %u", len, interp->maxArrayList);
    if (arrayindex >= 0 && (uint)arrayindex < interp->maxArrayList &&
        if (key >= 0 && (uint)key < interp->maxArrayList) {
//JSI Command Prototypes: version 3.0.8
<tr><td>maxArrayList</td><td><i>UINT</i></td><td>Maximum array convertable to list (100000).</td><td><i></i></td></tr>