tiny-js
tiny-js copied to clipboard
Division Exception
Enviroment
operating system: ubuntu18.04
compile command: make
test command: ./run_tests poc
poc:
https://drive.google.com/open?id=1pQIgme3iIyP2Z115HOoDSFD8dm5YneyY
vulnerability description:
There is a problem with CScriptVar :: mathsOp. On the TinyJS.cpp + 1060 line, a floating point arithmetic error is triggered, as shown in the figure:
The reason for the vulnerability is that during the calculation of the remainder operation, the division is actually calculated, but if the dividend is 0, the division floating point number is wrong.
PoC construction
In the process of declaring variables, 0 is used as the remainder.

false is actually 0.