chakra-core/ChakraCore
Auf GitHub ansehenAssertion failure in JavascriptArray::FindHelper()
Open
#6.541 geöffnet am 16. Dez. 2020
Bughelp wanted
Repository-Metriken
- Stars
- (9.000 Stars)
- PR-Merge-Metriken
- (Keine gemergten PRs in 30 T)
Beschreibung
Hello, executing following code in ch 1.22.24(debug), an assertion will be thrown.
var buffer = new Int8Array(8);
var func = function (elem) {
return elem;
};
i = 9007199254740992;
Object.defineProperty(buffer, 'length', { value: i });
Array.prototype.find.call(buffer, func);
output:
ASSERTION 2480: (c:\users\sunlili\documents\workspace\jsenginesfordebug\chakracore-1.11.24\lib\runtime\library\javascriptarray.cpp, line 8558) length <= UINT_MAX
Failure: (length <= 0xffffffff)
FATAL ERROR: ch.exe failed due to exception code c0000420
9007199254740992 is larger than Math::MAX_SAFE_INTEGER, so ch modified the length to Math::MAX_SAFE_INTEGER(9007199254740991 or 0x1F FFFF FFFF FFFF). Although length is modified larger than buffer's size, there is an index checking in BaseTypedDirectGetItem(__in uint32 index), which gets the real size of buffer, so the bug will not cause OOB access.
ISec Lab. 2020.12.16