YourWishes/jerryscript
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Limit the constructed string size in String.prototype.repeat (#3066)

Browse Source 
This patch fixes #3063.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
This commit is contained in:
Robert Fancsik
2019-09-07 12:20:57 +02:00
committed by Dániel Bátyai
parent 1b84a17dc7
commit 91818bea93
3 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jerry-core/ecma/builtin-objects/ecma-builtin-string-prototype.c
+6
View File
@@ -1913,6 +1913,12 @@ ecma_builtin_string_prototype_object_repeat (ecma_string_t *original_string_p, /
}
lit_utf8_size_t size = ecma_string_get_utf8_size (original_string_p);
if ((uint32_t) length >= (ECMA_STRING_SIZE_LIMIT / size))
{
return ecma_raise_range_error (ECMA_ERR_MSG ("Invalid string length"));
}
lit_utf8_size_t total_size = size * (lit_utf8_size_t) length;
JMEM_DEFINE_LOCAL_ARRAY (str_buffer, total_size, lit_utf8_byte_t);