Fix count variable calculation in typedarray copyWithin

Fixes #3130

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]

Author: szilagyiadam

jerry-core/api/jerry.c

@@ -3073,7 +3073,14 @@ jerry_create_arraybuffer (const jerry_length_t size) /**< size of the ArrayBuffe
   jerry_assert_api_available ();
 
 #if ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY)
-  return jerry_return (ecma_make_object_value (ecma_arraybuffer_new_object (size)));
+  ecma_object_t *arraybuffer_obj_p = ecma_arraybuffer_new_object (size);
+
+  if (JERRY_UNLIKELY (arraybuffer_obj_p == NULL))
+  {
+    return ecma_create_error_reference_from_context ();
+  }
+
+  return jerry_return (ecma_make_object_value (arraybuffer_obj_p));
 #else /* !ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY) */
   JERRY_UNUSED (size);
   return jerry_throw (ecma_raise_type_error (ECMA_ERR_MSG ("ArrayBuffer not supported.")));
@@ -3107,6 +3114,12 @@ jerry_create_arraybuffer_external (const jerry_length_t size, /**< size of the b
   ecma_object_t *arraybuffer = ecma_arraybuffer_new_object_external (size,
                                                                      buffer_p,
                                                                      (ecma_object_native_free_callback_t) free_cb);
+
+  if (JERRY_UNLIKELY (arraybuffer == NULL))
+  {
+    return ecma_create_error_reference_from_context ();
+  }
+
   return jerry_return (ecma_make_object_value (arraybuffer));
 #else /* !ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY) */
   JERRY_UNUSED (size);

jerry-core/ecma/builtin-objects/ecma-builtin-arraybuffer-prototype.c

@@ -129,6 +129,12 @@ ecma_builtin_arraybuffer_prototype_object_slice (ecma_value_t this_arg, /**< thi
   JERRY_ASSERT (start <= len && end <= len);
   ecma_length_t new_len = (end >= start) ? (end - start) : 0;
   ecma_object_t *new_arraybuffer_p = ecma_arraybuffer_new_object (new_len);
+
+  if (JERRY_UNLIKELY (new_arraybuffer_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
   lit_utf8_byte_t *old_buf = ecma_arraybuffer_get_buffer (object_p);
   lit_utf8_byte_t *new_buf = ecma_arraybuffer_get_buffer (new_arraybuffer_p);
 

jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c

@@ -1887,16 +1887,16 @@ ecma_builtin_typedarray_prototype_copy_within (ecma_value_t this_arg, /**< this
     }
   }
 
-  int32_t distance = (int32_t) (end - start);
-  int32_t offset = (int32_t) (length - target);
-  int32_t count = JERRY_MIN (distance, offset);
-
   if (target >= length || end == 0 || start >= end)
   {
     return ecma_copy_value (this_arg);
   }
   else
   {
+    uint32_t distance = end - start;
+    uint32_t offset = length - target;
+    uint32_t count = JERRY_MIN (distance, offset);
+
     memmove (typedarray_buffer_p + (target * element_size),
              typedarray_buffer_p + (start * element_size),
              (size_t) (count * element_size));

jerry-core/ecma/operations/ecma-arraybuffer-object.c

@@ -40,7 +40,7 @@
  *   extend_part
  *   data buffer
  *
- * @return ecma_object_t *
+ * @return ecma_object_t
  */
 ecma_object_t *
 ecma_arraybuffer_new_object (ecma_length_t length) /**< length of the arraybuffer */

tests/jerry/fail/regression-test-issue-3130.js

@@ -0,0 +1,23 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var arrb = new ArrayBuffer(2147483648);
+var arr = new Uint8Array(arrb);
+
+try {
+    arr.copyWithin({}, 8);
+    assert(false);
+} catch (e) {
+    assert (e instanceof RangeError);
+}