Quickjs-ng Heap-Based Buffer Overflow Vulnerability in BigInt Reader

A heap-based buffer overflow vulnerability has been identified in quickjs-ng versions through 0.9.0. The issue arises from an incorrect size calculation in the BigInt reading function, JS_ReadBigInt, which leads to the allocation of insufficient memory. This flaw allows for writing beyond the allocated buffer, creating a potential security risk.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling quickjs-ng with the AddressSanitizer (ASAN) enabled, and then using a crafted input that exploits the incorrect size calculation in the BigInt reader. This can be done by using a specific byte sequence that triggers the overflow when processed by the JavaScript engine.

Remediation

Users can update to quickjs-ng version 0.9.1 or later, where this vulnerability has been fixed.