Skip to content

Commit 1eb05e4

Browse files
author
Fabrice Bellard
committed
fixed buffer overflow in BJSON String and BigInt reader (#399)
1 parent a151ce1 commit 1eb05e4

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

quickjs.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35564,6 +35564,10 @@ static JSString *JS_ReadString(BCReaderState *s)
3556435564
return NULL;
3556535565
is_wide_char = len & 1;
3556635566
len >>= 1;
35567+
if (len > JS_STRING_LEN_MAX) {
35568+
JS_ThrowInternalError(s->ctx, "string too long");
35569+
return NULL;
35570+
}
3556735571
p = js_alloc_string(s->ctx, len, is_wide_char);
3556835572
if (!p) {
3556935573
s->error_state = -1;
@@ -35675,8 +35679,7 @@ static JSValue JS_ReadBigInt(BCReaderState *s)
3567535679
bc_read_trace(s, "}\n");
3567635680
return __JS_NewShortBigInt(s->ctx, 0);
3567735681
}
35678-
p = js_bigint_new(s->ctx,
35679-
(len + (JS_LIMB_BITS / 8) - 1) / (JS_LIMB_BITS / 8));
35682+
p = js_bigint_new(s->ctx, (len - 1) / (JS_LIMB_BITS / 8) + 1);
3568035683
if (!p)
3568135684
goto fail;
3568235685
for(i = 0; i < len / (JS_LIMB_BITS / 8); i++) {

0 commit comments

Comments
 (0)