RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 09:07:35 +00:00
Code Issues Activity Actions

LibJS: Handle OOB access in GenericIndexedPropertyStorage::take_last()

Browse source 
We already do this for the SimpleIndexedPropertyStorage, so for indexed
properties with GenericIndexedPropertyStorage this would previously
crash. Since overwriting the array-like size with a larger value won't
magically insert values at previously unset indices, we need to handle
such an out of bounds access gracefully and just return an empty value.

Fixes #7043.
This commit is contained in:
Linus Groh 2021-05-17 23:20:29 +01:00
parent c15121fef7
commit 63e8477a6b
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibJS/Runtime/IndexedProperties.cpp
View file

@ -160,8 +160,9 @@ ValueAndAttributes GenericIndexedPropertyStorage::take_last()
m_array_size--; m_array_size--;
auto result = m_sparse_elements.get(m_array_size); auto result = m_sparse_elements.get(m_array_size);
if (!result.has_value())
return {};
m_sparse_elements.remove(m_array_size); m_sparse_elements.remove(m_array_size);
VERIFY(result.has_value());
return result.value(); return result.value();
} }