surma
d44f1d9677
Checkpoint before integration and package validation. Assisted-by: SurmAgent:unknown [read] [edit] [bash]
26 lines
1.0 KiB
JavaScript
26 lines
1.0 KiB
JavaScript
// Bug: expand_fast_array calls max_int(new_len, new_size) where new_len is uint32_t.
|
|
// When new_len >= 0x80000000, cast to int makes it negative.
|
|
// max_int returns the small grow-by-50% size. Buffer is underallocated.
|
|
// add_fast_array_element then writes to values[new_len-1] — OOB write.
|
|
//
|
|
// Pre-fix behavior: process crashes with SIGBUS (OOB write to unmapped memory)
|
|
// Post-fix behavior: RangeError thrown and caught cleanly
|
|
//
|
|
// Run: qjs poc_test_fixed.js
|
|
// Expected output: PASS: got graceful error: ...
|
|
const arr = [1, 2, 3];
|
|
arr.length = 0x7FFFFFFF;
|
|
|
|
try {
|
|
const result = arr.push(4);
|
|
// Succeeded via slow array path — no crash, no heap corruption
|
|
print("PASS: push completed without crash, result:", result);
|
|
|
|
} catch(e) {
|
|
if (e instanceof RangeError || e instanceof TypeError) {
|
|
print("PASS: got graceful error:", e.message);
|
|
} else {
|
|
throw e; // unexpected — re-throw
|
|
}
|
|
}
|