High, CVSS 7.5crates.ioPublished
A BigInt division panics, and two neighbouring operations answer wrongly in silence
GHSA-6976-qm5m-7mcj
- Affected
- crates.io viperjs >= 0.0.0-0, < 0.2.2
- Fixed in
- 0.2.2· Vendor fix available
- Issue
- `viperjs` is a JavaScript engine intended to run untrusted script inside a host application, so script text is data rather than a trusted caller and a panic reachable from script is a denial of service in the embedder's process. A divisor whose magnitude lands exactly on the engine's internal limb ceiling reaches an out-of-bounds index. On every released version up to and including 0.2.1: ```js const d = (1n << 33554399n) * 2n; 1n / d; // panic: index out of bounds ``` Two further operations on the same value returned wrong results without raising anything, which is the more dangerous half for an embedder that acts on the answer: ```js d % 7n; // 0n — the true remainder is 1n String(d); // "0" ``` Cause The left-shift helper reserved one limb for the bits a shift may push past the top of the magnitude, measured *that* width against the size ceiling, and then trimmed the reserved limb away again — so a magnitude landing exactly on the ceiling was refused on account of room it does…
Recommended action: Upgrade to 0.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.