RandomHuman
/
Mypal
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Avoid uint32_t overflow in js shell by checking size.

This commit is contained in:
Fedor 2019-12-25 15:43:36 +03:00
parent fdec53dc93
commit 6c0079265a
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/shell/OSObject.cpp
View File

@ -184,6 +184,11 @@ FileAsTypedArray(JSContext* cx, JS::HandleString pathnameStr)
return nullptr;
JS_ReportErrorUTF8(cx, "can't seek start of %s", pathname.ptr());
} else {
if (len > INT32_MAX) {
JS_ReportErrorUTF8(cx, "file %s is too large for a Uint8Array",
pathname.ptr());
return nullptr;
}
obj = JS_NewUint8Array(cx, len);
if (!obj)
return nullptr;