asadbek064/quickjs
1
Fork 0
mirror of https://github.com/bellard/quickjs.git synced 2026-03-31 12:18:01 +00:00
Code Issues Actions Projects Releases Wiki Activity

Add tests for OOB access in atomic ops

Browse Source 
https://github.com/quickjs-ng/quickjs/issues/1301
https://github.com/quickjs-ng/quickjs/issues/1302
This commit is contained in:
Saúl Ibarra Corretgé 2026-01-06 10:57:24 +01:00 committed by Michal Suchanek
parent 4aa7c632ac
commit c1b62bbd72
3 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -454,6 +454,8 @@ test: qjs$(EXE)
$(WINE) ./qjs$(EXE) tests/test_bigint.js
$(WINE) ./qjs$(EXE) tests/test_cyclic_import.js
$(WINE) ./qjs$(EXE) tests/test_worker.js
$(WINE) ./qjs$(EXE) tests/bug1301.js
$(WINE) ./qjs$(EXE) tests/bug1302.js
ifndef CONFIG_WIN32
$(WINE) ./qjs$(EXE) tests/test_std.js
endif

21
tests/bug1301.js Normal file
View File

@ -0,0 +1,21 @@
/*---
features: [skip-if-tcc]
---*/
import {assert} from "./assert.js"
const rab = new ArrayBuffer(1024, { maxByteLength: 1024 * 1024 });
const i32 = new Int32Array(rab);
const evil = {
valueOf: () => {
rab.resize(0);
return 123;
}
};
try {
Atomics.store(i32, 0, evil);
throw Error("Should not get here");
} catch (e) {
assert(e instanceof RangeError);
}

24
tests/bug1302.js Normal file
View File

@ -0,0 +1,24 @@
/*---
features: [skip-if-tcc]
---*/
import {assert} from "./assert.js"
const rab = new ArrayBuffer(1024, { maxByteLength: 1024 * 1024 });
const i32 = new Int32Array(rab);
const evil = {
valueOf: () => {
rab.resize(0);
return 123;
}
};
try {
Atomics.add(i32, 0, evil);
// Atomics.sub(i32, 0, evil);
// Atomics.and(i32, 0, evil);
// Atomics.or(i32, 0, evil);
// Atomics.xor(i32, 0, evil);
throw Error("Should not get here");
} catch (e) {
assert(e instanceof RangeError);
}