wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 15:28:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Avoid uint32_t overflow in js shell by checking size of file before

Browse source 
trying to stuff something insanely large into a Uint8Array.

See also: BMO 1571911
This commit is contained in:
wolfbeast 2019-10-22 20:57:58 +02:00 • committed by Roy Tam
commit 4a024d6b52
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
js/src/shell/OSObject.cpp
View file

@ -184,6 +184,11 @@ FileAsTypedArray(JSContext* cx, JS::HandleString pathnameStr)
return nullptr;
JS_ReportErrorUTF8(cx, "can't seek start of %s", pathname.ptr());
} else {
if (len > INT32_MAX) {
JS_ReportErrorUTF8(cx, "file %s is too large for a Uint8Array",
pathname.ptr());
return nullptr;
}
obj = JS_NewUint8Array(cx, len);
if (!obj)
return nullptr;