beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-29 16:21:29 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

LibJS: Disallow creating ArrayBuffers larger than 2^53 - 1

Browse source 
This is a normative change in the ECMA-262 spec. See:
https://github.com/tc39/ecma262/commit/25f9744
This commit is contained in:
Timothy Flynn 2023-05-25 11:22:01 -04:00 committed by Andreas Kling
parent d31b780760
commit 706a20c4d4
Notes: sideshowbarker 2024-07-17 16:23:55 +09:00 
Author: https://github.com/trflynn89
Commit: https://github.com/SerenityOS/serenity/commit/706a20c4d4
Pull-request: https://github.com/SerenityOS/serenity/pull/19039
2 changed files with 25 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
Userland/Libraries/LibJS/Runtime/ArrayBuffer.cpp
View file

@ -50,6 +50,23 @@ void ArrayBuffer::visit_edges(Cell::Visitor& visitor)
visitor.visit(m_detach_key);
}
// 6.2.9.1 CreateByteDataBlock ( size ), https://tc39.es/ecma262/#sec-createbytedatablock
static ThrowCompletionOr<ByteBuffer> create_byte_data_block(VM& vm, size_t size)
{
// 1. If size > 2^53 - 1, throw a RangeError exception.
if (size > MAX_ARRAY_LIKE_INDEX)
return vm.throw_completion<RangeError>(ErrorType::InvalidLength, "array buffer");
// 2. Let db be a new Data Block value consisting of size bytes. If it is impossible to create such a Data Block, throw a RangeError exception.
// 3. Set all of the bytes of db to 0.
auto data_block = ByteBuffer::create_zeroed(size);
if (data_block.is_error())
return vm.throw_completion<RangeError>(ErrorType::NotEnoughMemoryToAllocate, size);
// 4. Return db.
return data_block.release_value();
}
// 25.1.2.1 AllocateArrayBuffer ( constructor, byteLength ), https://tc39.es/ecma262/#sec-allocatearraybuffer
ThrowCompletionOr<ArrayBuffer*> allocate_array_buffer(VM& vm, FunctionObject& constructor, size_t byte_length)
{
@ -57,12 +74,10 @@ ThrowCompletionOr<ArrayBuffer*> allocate_array_buffer(VM& vm, FunctionObject& co
auto obj = TRY(ordinary_create_from_constructor<ArrayBuffer>(vm, constructor, &Intrinsics::array_buffer_prototype, nullptr));
// 2. Let block be ? CreateByteDataBlock(byteLength).
auto block = ByteBuffer::create_zeroed(byte_length);
if (block.is_error())
return vm.throw_completion<RangeError>(ErrorType::NotEnoughMemoryToAllocate, byte_length);
auto block = TRY(create_byte_data_block(vm, byte_length));
// 3. Set obj.[[ArrayBufferData]] to block.
obj->set_buffer(block.release_value());
obj->set_buffer(move(block));
// 4. Set obj.[[ArrayBufferByteLength]] to byteLength.

6
Userland/Libraries/LibJS/Tests/builtins/ArrayBuffer/ArrayBuffer.js
View file

@ -11,3 +11,9 @@ test("ArrayBuffer constructor must be invoked with 'new'", () => {
ArrayBuffer();
}).toThrowWithMessage(TypeError, "ArrayBuffer constructor must be called with 'new'");
});
test("ArrayBuffer size limit", () => {
expect(() => {
new ArrayBuffer(2 ** 53);
}).toThrowWithMessage(RangeError, "Invalid array buffer length");
});