From 7163430d1ad41e02e1aab2de00488ba27588d7d7 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Wed, 5 Feb 2025 15:29:23 +0100
Subject: [PATCH] Null-check inputs for String and BigInt

Crash fix for null crash when feeding bogus strings or BigInts to
StructuredClone.
---
 js/src/vm/StructuredClone.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
index 93f4fae626..25e9e93b3b 100644
--- a/js/src/vm/StructuredClone.cpp
+++ b/js/src/vm/StructuredClone.cpp
@@ -1059,6 +1059,11 @@ JSStructuredCloneWriter::reportDataCloneError(uint32_t errorId)
 bool
 JSStructuredCloneWriter::writeString(uint32_t tag, JSString* str)
 {
+    // Nullcheck input
+    if (!str) {
+      return false;
+    }
+    
     JSLinearString* linear = str->ensureLinear(context());
     if (!linear)
         return false;
@@ -1079,6 +1084,11 @@ JSStructuredCloneWriter::writeString(uint32_t tag, JSString* str)
 bool
 JSStructuredCloneWriter::writeBigInt(uint32_t tag, BigInt* bi)
 {
+    // Nullcheck input
+    if (!bi) {
+      return false;
+    }
+    
     bool signBit = bi->isNegative();
     size_t length = bi->digitLength();
     // The length must fit in 31 bits to leave room for a sign bit.