wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 15:17:29 +09:00
Code Issues Projects Releases Packages Wiki Activity

Null-check inputs for String and BigInt

Browse source 
Crash fix for null crash when feeding bogus strings or BigInts to
StructuredClone.
This commit is contained in:
Moonchild 2025-02-05 15:29:23 +01:00 • committed by roytam1
commit 7163430d1a
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
js/src/vm/StructuredClone.cpp
View file

@ -1059,6 +1059,11 @@ JSStructuredCloneWriter::reportDataCloneError(uint32_t errorId)
bool bool
JSStructuredCloneWriter::writeString(uint32_t tag, JSString* str) JSStructuredCloneWriter::writeString(uint32_t tag, JSString* str)
{ {
// Nullcheck input
if (!str) {
return false;
}
JSLinearString* linear = str->ensureLinear(context()); JSLinearString* linear = str->ensureLinear(context());
if (!linear) if (!linear)
return false; return false;
@ -1079,6 +1084,11 @@ JSStructuredCloneWriter::writeString(uint32_t tag, JSString* str)
bool bool
JSStructuredCloneWriter::writeBigInt(uint32_t tag, BigInt* bi) JSStructuredCloneWriter::writeBigInt(uint32_t tag, BigInt* bi)
{ {
// Nullcheck input
if (!bi) {
return false;
}
bool signBit = bi->isNegative(); bool signBit = bi->isNegative();
size_t length = bi->digitLength(); size_t length = bi->digitLength();
// The length must fit in 31 bits to leave room for a sign bit. // The length must fit in 31 bits to leave room for a sign bit.