njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.
cpe:2.3:a:f5:njs:*:*:*:*:*:*:*:*
3F70BB50-E3EC-44F8-BC1A-D514EA261742
0.3.1
OR
NJS version
```
changeset:   965:e0fdef4eb478
tag:         tip
user:        Dmitry Volyntsev <xeioex@nginx.com>
date:        Thu May 16 15:20:31 2019 +0300
summary:     Fixed uninitialized-memory-access in Object.defineProperties().
```

JavaScript testcase:
```js
var v0=Array()
while(v0.includes(v0.u,(Object()+((Boolean))),(Boolean),((({}>(Boolean)))),(0),v0.toString(([URIError]+Object))){}
```

ASAN log:
```
==32113==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000480 at pc 0x5561174c6af1 bp 0x7ffd29774220 sp 0x7ffd29774210
WRITE of size 16 at 0x619000000480 thread T0
    #0 0x5561174c6af0 in njs_function_native_call njs/njs_function.c:623
    #1 0x5561173e36b1 in njs_vmcode_continuation njs/njs_vm.c:2308
    #2 0x5561173e3d47 in njs_vmcode_interpreter njs/njs_vm.c:159
    #3 0x5561173deb83 in njs_vm_start njs/njs.c:594
    #4 0x5561173c1cc3 in njs_process_script njs/njs_shell.c:770
    #5 0x5561173baf48 in njs_process_file njs/njs_shell.c:619
    #6 0x5561173baf48 in main njs/njs_shell.c:281
    #7 0x7f37a800db96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #8 0x5561173bcef9 in _start (/home/build/njs/build/njs+0x2aef9)
```
Found by [fluff](https://github.com/Samsung/Fluff)
heap-buffer-overflow in njs_function_native_call njs/njs_function.c:623
This is a GitHub Issue
repo:njs
owner:nginx
Title : heap-buffer-overflow in njs_function_native_call njs/njs_function.c:623
Issue date:

--- start body ---
NJS version
```
changeset:   965:e0fdef4eb478
tag:         tip
user:        Dmitry Volyntsev <xeioex@nginx.com>
date:        Thu May 16 15:20:31 2019 +0300
summary:     Fixed uninitialized-memory-access in Object.defineProperties().
```

JavaScript testcase:
```js
var v0=Array()
while(v0.includes(v0.u,(Object()+((Boolean))),(Boolean),((({}>(Boolean)))),(0),v0.toString(([URIError]+Object))){}
```

ASAN log:
```
==32113==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000480 at pc 0x5561174c6af1 bp 0x7ffd29774220 sp 0x7ffd29774210
WRITE of size 16 at 0x619000000480 thread T0
    #0 0x5561174c6af0 in njs_function_native_call njs/njs_function.c:623
    #1 0x5561173e36b1 in njs_vmcode_continuation njs/njs_vm.c:2308
    #2 0x5561173e3d47 in njs_vmcode_interpreter njs/njs_vm.c:159
    #3 0x5561173deb83 in njs_vm_start njs/njs.c:594
    #4 0x5561173c1cc3 in njs_process_script njs/njs_shell.c:770
    #5 0x5561173baf48 in njs_process_file njs/njs_shell.c:619
    #6 0x5561173baf48 in main njs/njs_shell.c:281
    #7 0x7f37a800db96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #8 0x5561173bcef9 in _start (/home/build/njs/build/njs+0x2aef9)
```
Found by [fluff](https://github.com/Samsung/Fluff)
--- end body ---

comments :
--- start comments ---

--- end comments ---