Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_vm.c function.
cpe:2.3:a:nginx:njs:*:*:*:*:*:*:*:*
19A4B578-8508-4F14-AF9A-8C6AF2CB12C6
0.3.4
cpe:2.3:a:nginx:njs:2019-06-27:*:*:*:*:*:*:*
76C92D85-F51F-4CD4-8DC4-BD4428A3C0E1
OR
# env
ubuntu 18.04
njs 0feca92
gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)
built with ASAN on

# bug
```javascript
> (1..__proto__.length = '1', Array.prototype.slice.call(1, 0, 2)).toString()
ASAN:SIGSEGV
=================================================================
==13918==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000407181 bp 0x7ffdf2511450 sp 0x7ffdf2511430 T0)
    #0 0x407180 in nxt_lvlhsh_find nxt/nxt_lvlhsh.c:181
    #1 0x4479b7 in njs_object_property njs/njs_object_property.c:757
    #2 0x4210c2 in njs_primitive_value njs/njs_vm.c:2987
    #3 0x4206ec in njs_vmcode_string_argument njs/njs_vm.c:2864
    #4 0x41473f in njs_vmcode_interpreter njs/njs_vm.c:159
    #5 0x412c4e in njs_vm_start njs/njs.c:594
    #6 0x404a75 in njs_process_script njs/njs_shell.c:771
    #7 0x40387b in njs_interactive_shell njs/njs_shell.c:501
    #8 0x402ad1 in main njs/njs_shell.c:271
```
Array elements left uninitialized in Array.prototype.slice() for primitive this values.
This is a GitHub Issue
repo:njs
owner:nginx
Title : Array elements left uninitialized in Array.prototype.slice() for primitive this values.
Issue date:

--- start body ---
# env
ubuntu 18.04
njs 0feca92
gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)
built with ASAN on

# bug
```javascript
> (1..__proto__.length = '1', Array.prototype.slice.call(1, 0, 2)).toString()
ASAN:SIGSEGV
=================================================================
==13918==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000407181 bp 0x7ffdf2511450 sp 0x7ffdf2511430 T0)
    #0 0x407180 in nxt_lvlhsh_find nxt/nxt_lvlhsh.c:181
    #1 0x4479b7 in njs_object_property njs/njs_object_property.c:757
    #2 0x4210c2 in njs_primitive_value njs/njs_vm.c:2987
    #3 0x4206ec in njs_vmcode_string_argument njs/njs_vm.c:2864
    #4 0x41473f in njs_vmcode_interpreter njs/njs_vm.c:159
    #5 0x412c4e in njs_vm_start njs/njs.c:594
    #6 0x404a75 in njs_process_script njs/njs_shell.c:771
    #7 0x40387b in njs_interactive_shell njs/njs_shell.c:501
    #8 0x402ad1 in main njs/njs_shell.c:271
```
--- end body ---

comments :
--- start comments ---

--- end comments ---