LibJS: Use Checked<T> for offsets in the GetViewValue AO

Fixes #9336.
Author: https://github.com/linusg Commit: 6fc0b2a43d Pull-request: https://github.com/SerenityOS/serenity/pull/9348
2025-08-01 05:39:11 +00:00 · 2021-08-11 22:12:26 +01:00 · 2021-08-11 22:12:26 +01:00 · 6fc0b2a43d · 2024-07-18 07:06:33 +09:00
commit 6fc0b2a43d
parent b2a849935b
2 changed files with 19 additions and 3 deletions
--- a/Userland/Libraries/LibJS/Tests/builtins/DataView/DataView-invalid-read-and-write.js
+++ b/Userland/Libraries/LibJS/Tests/builtins/DataView/DataView-invalid-read-and-write.js
@ -0,0 +1,9 @@
+test("Issue #9336, integer overflow in get_view_value", () => {
+    const dataView = new DataView(new ArrayBuffer(16));
+    expect(() => {
+        dataView.getUint32(0xfffffffc);
+    }).toThrowWithMessage(
+        RangeError,
+        "Data view byte offset 4294967292 is out of range for buffer with length 16"
+    );
+});