RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 20:47:45 +00:00
Code Issues Activity Actions

LibJS: Add overflow checks when creating TypedArray from ArrayBuffer

Browse source 
Thanks to Iliad for finding this! :^)
This commit is contained in:
Andreas Kling 2021-01-27 07:50:46 +01:00
parent c899ace3ad
commit f6c6047e49
2 changed files with 28 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Userland/Libraries/LibJS/Tests/builtins/TypedArray/typed-array-from-ArrayBuffer-bad-offset.js Normal file
View file

@ -0,0 +1,5 @@
test("construct Uint32Array with zero-length ArrayBuffer and overflowing offset", () => {
expect(() => new Uint32Array(new ArrayBuffer(0), 4, 1024 * 1024 * 1024 - 1)).toThrow(
RangeError
);
});