RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 18:57:35 +00:00
Code Issues Activity Actions

Everywhere: Fix incorrect usages of AK::Checked

Browse source 
Specifically, explicitly specify the checked type, use the resulting
value instead of doing the same calculation twice, and break down
calculations to discrete operations to ensure no intermediary overflows
are missed.
This commit is contained in:
Idan Horowitz 2021-07-04 20:23:26 +03:00 • committed by Linus Groh
parent 3f70efed9c
commit 301c1a3a58
6 changed files with 16 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibJS/Runtime/TypedArray.cpp
View file

@ -97,7 +97,8 @@ static void initialize_typed_array_from_typed_array(GlobalObject& global_object,
auto element_length = src_array.array_length();
auto element_size = dest_array.element_size();
Checked byte_length = element_size * element_length;
Checked<size_t> byte_length = element_size;
byte_length *= element_length;
if (byte_length.has_overflow()) {
vm.throw_exception<RangeError>(global_object, ErrorType::InvalidLength, "typed array");
return;

4
Userland/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp
View file

@ -362,7 +362,7 @@ JS_DEFINE_NATIVE_FUNCTION(TypedArrayPrototype::set)
return {};
}
Checked checked { source_length };
Checked<size_t> checked = source_length;
checked += static_cast<u32>(target_offset);
if (checked.has_overflow() || checked.value() > target_length) {
vm.throw_exception<JS::RangeError>(global_object, "Overflow or out of bounds in target length");
@ -436,7 +436,7 @@ JS_DEFINE_NATIVE_FUNCTION(TypedArrayPrototype::set)
return {};
}
Checked checked { source_length };
Checked<size_t> checked = source_length;
checked += static_cast<u32>(target_offset);
if (checked.has_overflow() || checked.value() > target_length) {
vm.throw_exception<JS::RangeError>(global_object, "Overflow or out of bounds in target length");