Limit arraybuffer allocation size

Fixes #3130
Previously we could allocate more than INT32_MAX size for the
arraybuffer, but thats a wrong behaviour, now we limited this size.

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]

Author: szilagyiadam

jerry-core/api/jerry.c

@@ -3073,7 +3073,14 @@ jerry_create_arraybuffer (const jerry_length_t size) /**< size of the ArrayBuffe
   jerry_assert_api_available ();
 
 #if ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY)
-  return jerry_return (ecma_make_object_value (ecma_arraybuffer_new_object (size)));
+  ecma_object_t *arraybuffer_obj_p = ecma_arraybuffer_new_object (size);
+
+  if (JERRY_UNLIKELY (arraybuffer_obj_p == NULL))
+  {
+    return ecma_create_error_reference_from_context ();
+  }
+
+  return jerry_return (ecma_make_object_value (arraybuffer_obj_p));
 #else /* !ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY) */
   JERRY_UNUSED (size);
   return jerry_throw (ecma_raise_type_error (ECMA_ERR_MSG ("ArrayBuffer not supported.")));
@@ -3107,6 +3114,12 @@ jerry_create_arraybuffer_external (const jerry_length_t size, /**< size of the b
   ecma_object_t *arraybuffer = ecma_arraybuffer_new_object_external (size,
                                                                      buffer_p,
                                                                      (ecma_object_native_free_callback_t) free_cb);
+
+  if (JERRY_UNLIKELY (arraybuffer == NULL))
+  {
+    return ecma_create_error_reference_from_context ();
+  }
+
   return jerry_return (ecma_make_object_value (arraybuffer));
 #else /* !ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY) */
   JERRY_UNUSED (size);

jerry-core/ecma/builtin-objects/ecma-builtin-arraybuffer-prototype.c

@@ -129,6 +129,12 @@ ecma_builtin_arraybuffer_prototype_object_slice (ecma_value_t this_arg, /**< thi
   JERRY_ASSERT (start <= len && end <= len);
   ecma_length_t new_len = (end >= start) ? (end - start) : 0;
   ecma_object_t *new_arraybuffer_p = ecma_arraybuffer_new_object (new_len);
+
+  if (JERRY_UNLIKELY (new_arraybuffer_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
   lit_utf8_byte_t *old_buf = ecma_arraybuffer_get_buffer (object_p);
   lit_utf8_byte_t *new_buf = ecma_arraybuffer_get_buffer (new_arraybuffer_p);
 

jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c

@@ -1887,16 +1887,16 @@ ecma_builtin_typedarray_prototype_copy_within (ecma_value_t this_arg, /**< this
     }
   }
 
-  int32_t distance = (int32_t) (end - start);
-  int32_t offset = (int32_t) (length - target);
-  int32_t count = JERRY_MIN (distance, offset);
-
   if (target >= length || end == 0 || start >= end)
   {
     return ecma_copy_value (this_arg);
   }
   else
   {
+    uint32_t distance = end - start;
+    uint32_t offset = length - target;
+    uint32_t count = JERRY_MIN (distance, offset);
+
     memmove (typedarray_buffer_p + (target * element_size),
              typedarray_buffer_p + (start * element_size),
              (size_t) (count * element_size));

jerry-core/ecma/operations/ecma-arraybuffer-object.c

@@ -40,11 +40,18 @@
  *   extend_part
  *   data buffer
  *
- * @return ecma_object_t *
+ * @return NULL - if the length is not valid
+ *         pointer to the arraybuffer object - otherwise
  */
 ecma_object_t *
 ecma_arraybuffer_new_object (ecma_length_t length) /**< length of the arraybuffer */
 {
+  if (length >= INT32_MAX)
+  {
+    ecma_raise_range_error (ECMA_ERR_MSG ("Array buffer allocation failed"));
+    return NULL;
+  }
+
   ecma_object_t *prototype_obj_p = ecma_builtin_get (ECMA_BUILTIN_ID_ARRAYBUFFER_PROTOTYPE);
   ecma_object_t *object_p = ecma_create_object (prototype_obj_p,
                                                 sizeof (ecma_extended_object_t) + length,
@@ -76,6 +83,12 @@ ecma_arraybuffer_new_object_external (ecma_length_t length, /**< length of the b
                                       void *buffer_p, /**< pointer for ArrayBuffer's buffer backing */
                                       ecma_object_native_free_callback_t free_cb) /**< buffer free callback */
 {
+  if (length >= INT32_MAX)
+  {
+    ecma_raise_range_error (ECMA_ERR_MSG ("Array buffer allocation failed"));
+    return NULL;
+  }
+
   ecma_object_t *prototype_obj_p = ecma_builtin_get (ECMA_BUILTIN_ID_ARRAYBUFFER_PROTOTYPE);
   ecma_object_t *object_p = ecma_create_object (prototype_obj_p,
                                                 sizeof (ecma_arraybuffer_external_info),
@@ -146,7 +159,14 @@ ecma_op_create_arraybuffer_object (const ecma_value_t *arguments_list_p, /**< li
 
   uint32_t length_uint32 = ecma_number_to_uint32 (length_num);
 
-  return ecma_make_object_value (ecma_arraybuffer_new_object (length_uint32));
+  ecma_object_t *arraybuffer_obj_p = ecma_arraybuffer_new_object (length_uint32);
+
+  if (JERRY_UNLIKELY (arraybuffer_obj_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
+  return ecma_make_object_value (arraybuffer_obj_p);
 } /* ecma_op_create_arraybuffer_object */
 
 /**

jerry-core/ecma/operations/ecma-typedarray-object.c

@@ -243,7 +243,15 @@ ecma_typedarray_create_object_with_length (ecma_length_t array_length, /**< leng
     return ecma_raise_range_error (ECMA_ERR_MSG ("Maximum typedarray size is reached."));
   }
 
-  ecma_value_t new_arraybuffer_p = ecma_make_object_value (ecma_arraybuffer_new_object (byte_length));
+  ecma_object_t *arraybuffer_obj_p = ecma_arraybuffer_new_object (byte_length);
+
+  if (JERRY_UNLIKELY (arraybuffer_obj_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
+  ecma_value_t new_arraybuffer_p = ecma_make_object_value (arraybuffer_obj_p);
+
   ecma_object_t *object_p = ecma_create_object (proto_p,
                                                 sizeof (ecma_extended_object_t),
                                                 ECMA_OBJECT_TYPE_PSEUDO_ARRAY);

tests/jerry/fail/regression-test-issue-3130.js

@@ -0,0 +1,23 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var arrb = new ArrayBuffer(2147483648);
+var arr = new Uint8Array(arrb);
+
+try {
+    arr.copyWithin({}, 8);
+    assert(false);
+} catch (e) {
+    assert (e instanceof RangeError);
+}