diff --git a/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp b/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp index f121a15bccd..aced9071065 100644 --- a/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp +++ b/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp @@ -1433,7 +1433,11 @@ static ThrowCompletionOr set_typed_array_from_typed_array(VM& vm, TypedArr // 16. If srcLength + targetOffset > targetLength, throw a RangeError exception. Checked checked = source_length; - checked += static_cast(target_offset); + + if (target_offset > static_cast(NumericLimits::max())) + return vm.throw_completion(ErrorType::TypedArrayOverflowOrOutOfBounds, "target offset"); + checked += static_cast(target_offset); + if (checked.has_overflow() || checked.value() > target_length) return vm.throw_completion(ErrorType::TypedArrayOverflowOrOutOfBounds, "target length"); @@ -1539,7 +1543,11 @@ static ThrowCompletionOr set_typed_array_from_array_like(VM& vm, TypedArra // 7. If srcLength + targetOffset > targetLength, throw a RangeError exception. Checked checked = source_length; - checked += static_cast(target_offset); + + if (target_offset > static_cast(NumericLimits::max())) + return vm.throw_completion(ErrorType::TypedArrayOverflowOrOutOfBounds, "target offset"); + checked += static_cast(target_offset); + if (checked.has_overflow() || checked.value() > target_length) return vm.throw_completion(ErrorType::TypedArrayOverflowOrOutOfBounds, "target length"); diff --git a/Libraries/LibJS/Tests/builtins/TypedArray/TypedArray.prototype.set.js b/Libraries/LibJS/Tests/builtins/TypedArray/TypedArray.prototype.set.js index 7c29185665d..e9fcd80e2cb 100644 --- a/Libraries/LibJS/Tests/builtins/TypedArray/TypedArray.prototype.set.js +++ b/Libraries/LibJS/Tests/builtins/TypedArray/TypedArray.prototype.set.js @@ -146,3 +146,19 @@ test("detached buffer", () => { expect(typedArray.length).toBe(0); }); }); + +test("very large targetOffset", () => { + TYPED_ARRAYS.forEach(({ array: T }) => { + let typedArray = new T(); + + expect(() => { + // set_typed_array_from_typed_array + typedArray.set(typedArray, 2 ** 128); + }).toThrowWithMessage(RangeError, "Overflow or out of bounds in target offset"); + + expect(() => { + // set_typed_array_from_array_like + typedArray.set([], 2 ** 128); + }).toThrowWithMessage(RangeError, "Overflow or out of bounds in target offset"); + }); +});