Null pointer dereference

[bird8693]

Enviroment

operating system: ubuntu18.04
compile command: ./configure && make
test command: ./run_tests poc

poc:

https://drive.google.com/open?id=15YVLxLCZAALuP1HqbGctFEHsDd0KaDcJ

vulnerability description:

First observe the stack traceback, as shown in the figure:

It is a problem with CTinyJS :: term. On the TinyJS.cpp: 1736 line, a null pointer reference is triggered, as shown in the figure:

The reason for the vulnerability is that when the temporary assignment variable b is generated, it is not verified whether b is empty, and then b-> var refers to b, which causes the vulnerability.

There is a '\ x00' character after the "" here, causing tiny-js to think that the "" is empty after the parsing process, so the base parsing function returns 0, and "b-> var" is not checked before the reference , Which in turn produced the vulnerability.

PoC construction

In the process of declaring a variable, a null pointer can be caused by adding a null character after "*".

That is, a null character is added after the multiplication symbol.