ChaiScript Uncontrolled Recursion Vulnerability in Evaluation Function

A stack overflow vulnerability due to uncontrolled recursion has been identified in ChaiScript versions through 6.1.0. The issue arises in the evaluation function 'chaiscript::eval::AST_Node_Impl::eval' and 'chaiscript::eval::Function_Push_Pop', located in 'include/chaiscript/language/chaiscript_eval.hpp'. This vulnerability requires local exploitation and has been publicly disclosed, with an available proof-of-concept exploit.

Impact

Exploitation of this vulnerability leads to a stack overflow, causing the host process to crash.

Reproduction

To reproduce this vulnerability, build ChaiScript with release optimization and AddressSanitizer (ASan) enabled. Then, run the ChaiScript interpreter with a script that defines a recursive operator, such as one that string interpolates and calls itself. The AddressSanitizer will report the stack overflow error, confirming the vulnerability.