mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-07 08:39:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibJS: Use Checked<T> for offsets in the SetViewValue AO

Browse source 
Fixes #9338.
This commit is contained in:
Linus Groh 2021-08-11 22:16:25 +01:00
commit 84053816d5
Notes: sideshowbarker 2024-07-18 07:06:29 +09:00
2 changed files with 29 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
Userland/Libraries/LibJS/Tests/builtins/DataView/DataView-invalid-read-and-write.js
View file

@ -7,3 +7,23 @@ test("Issue #9336, integer overflow in get_view_value", () => {
"Data view byte offset 4294967292 is out of range for buffer with length 16"
);
});
test("Issue #9338, integer overflow in set_view_value", () => {
const dataView = new DataView(new ArrayBuffer(16));
expect(() => {
dataView.setUint32(0xfffffffc, 0);
}).toThrowWithMessage(
RangeError,
"Data view byte offset 4294967292 is out of range for buffer with length 16"
);
});
test("Issue #9338, integer overflow in set_view_value - zero-length DataView", () => {
const dataView = new DataView(new ArrayBuffer(4), 4);
expect(() => {
dataView.setUint32(0xfffffffc, 0);
}).toThrowWithMessage(
RangeError,
"Data view byte offset 4294967292 is out of range for buffer with length 0"
);
});