1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 18:27:35 +00:00

LibJS: Add bounds check to Array.prototype.{find,findIndex}

The number of iterations is limited to the initial array size, but we
still need to check if the array did shrink since then before accessing
each element.

Fixes #1992.
This commit is contained in:
Linus Groh 2020-04-28 00:26:00 +01:00 committed by Andreas Kling
parent 92671be906
commit c14fedd562
2 changed files with 31 additions and 0 deletions

View file

@ -441,6 +441,9 @@ Value ArrayPrototype::find(Interpreter& interpreter)
auto array_size = array->elements().size();
for (size_t i = 0; i < array_size; ++i) {
if (i >= array->elements().size())
break;
auto value = array->elements().at(i);
if (value.is_empty())
continue;
@ -475,6 +478,9 @@ Value ArrayPrototype::find_index(Interpreter& interpreter)
auto array_size = array->elements().size();
for (size_t i = 0; i < array_size; ++i) {
if (i >= array->elements().size())
break;
auto value = array->elements().at(i);
if (value.is_empty())
continue;