RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 09:48:11 +00:00
Code Issues Activity Actions

LibJS: Use Checked<T> for offsets in the GetViewValue AO

Browse source 
Fixes #9336.
This commit is contained in:
Linus Groh 2021-08-11 22:12:26 +01:00
parent b2a849935b
commit 6fc0b2a43d
2 changed files with 19 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Userland/Libraries/LibJS/Tests/builtins/DataView/DataView-invalid-read-and-write.js Normal file
View file

@ -0,0 +1,9 @@
test("Issue #9336, integer overflow in get_view_value", () => {
const dataView = new DataView(new ArrayBuffer(16));
expect(() => {
dataView.getUint32(0xfffffffc);
}).toThrowWithMessage(
RangeError,
"Data view byte offset 4294967292 is out of range for buffer with length 16"
);
});