Limit arraybuffer allocation size

Fixes #3130
Previously we could allocate more than INT32_MAX size for the
arraybuffer, but thats a wrong behaviour, now we limited this size.

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]

Author: szilagyiadam

jerry-core/api/jerry.c

@@ -3073,7 +3073,14 @@ jerry_create_arraybuffer (const jerry_length_t size) /**< size of the ArrayBuffe
   jerry_assert_api_available ();
 
 #if ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY)
-  return jerry_return (ecma_make_object_value (ecma_arraybuffer_new_object (size)));
+  ecma_object_t *arraybuffer_obj_p = ecma_arraybuffer_new_object (size);
+
+  if (JERRY_UNLIKELY (arraybuffer_obj_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
+  return jerry_return (ecma_make_object_value (arraybuffer_obj_p));
 #else /* !ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY) */
   JERRY_UNUSED (size);
   return jerry_throw (ecma_raise_type_error (ECMA_ERR_MSG ("ArrayBuffer not supported.")));
@@ -3107,6 +3114,12 @@ jerry_create_arraybuffer_external (const jerry_length_t size, /**< size of the b
   ecma_object_t *arraybuffer = ecma_arraybuffer_new_object_external (size,
                                                                      buffer_p,
                                                                      (ecma_object_native_free_callback_t) free_cb);
+
+  if (JERRY_UNLIKELY (arraybuffer == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
   return jerry_return (ecma_make_object_value (arraybuffer));
 #else /* !ENABLED (JERRY_ES2015_BUILTIN_TYPEDARRAY) */
   JERRY_UNUSED (size);

jerry-core/ecma/builtin-objects/ecma-builtin-arraybuffer-prototype.c

@@ -129,6 +129,12 @@ ecma_builtin_arraybuffer_prototype_object_slice (ecma_value_t this_arg, /**< thi
   JERRY_ASSERT (start <= len && end <= len);
   ecma_length_t new_len = (end >= start) ? (end - start) : 0;
   ecma_object_t *new_arraybuffer_p = ecma_arraybuffer_new_object (new_len);
+
+  if (JERRY_UNLIKELY (new_arraybuffer_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
   lit_utf8_byte_t *old_buf = ecma_arraybuffer_get_buffer (object_p);
   lit_utf8_byte_t *new_buf = ecma_arraybuffer_get_buffer (new_arraybuffer_p);
 

jerry-core/ecma/operations/ecma-arraybuffer-object.c

@@ -45,6 +45,12 @@
 ecma_object_t *
 ecma_arraybuffer_new_object (ecma_length_t length) /**< length of the arraybuffer */
 {
+  if (length >= INT32_MAX)
+  {
+    ecma_raise_range_error (ECMA_ERR_MSG ("Array buffer allocation failed"));
+    return NULL;
+  }
+
   ecma_object_t *prototype_obj_p = ecma_builtin_get (ECMA_BUILTIN_ID_ARRAYBUFFER_PROTOTYPE);
   ecma_object_t *object_p = ecma_create_object (prototype_obj_p,
                                                 sizeof (ecma_extended_object_t) + length,
@@ -76,6 +82,12 @@ ecma_arraybuffer_new_object_external (ecma_length_t length, /**< length of the b
                                       void *buffer_p, /**< pointer for ArrayBuffer's buffer backing */
                                       ecma_object_native_free_callback_t free_cb) /**< buffer free callback */
 {
+  if (length >= INT32_MAX)
+  {
+    ecma_raise_range_error (ECMA_ERR_MSG ("Array buffer allocation failed"));
+    return NULL;
+  }
+
   ecma_object_t *prototype_obj_p = ecma_builtin_get (ECMA_BUILTIN_ID_ARRAYBUFFER_PROTOTYPE);
   ecma_object_t *object_p = ecma_create_object (prototype_obj_p,
                                                 sizeof (ecma_arraybuffer_external_info),
@@ -146,7 +158,14 @@ ecma_op_create_arraybuffer_object (const ecma_value_t *arguments_list_p, /**< li
 
   uint32_t length_uint32 = ecma_number_to_uint32 (length_num);
 
-  return ecma_make_object_value (ecma_arraybuffer_new_object (length_uint32));
+  ecma_object_t *arraybuffer_obj_p = ecma_arraybuffer_new_object (length_uint32);
+
+  if (JERRY_UNLIKELY (arraybuffer_obj_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
+  return ecma_make_object_value (arraybuffer_obj_p);
 } /* ecma_op_create_arraybuffer_object */
 
 /**

jerry-core/ecma/operations/ecma-typedarray-object.c

@@ -243,7 +243,15 @@ ecma_typedarray_create_object_with_length (ecma_length_t array_length, /**< leng
     return ecma_raise_range_error (ECMA_ERR_MSG ("Maximum typedarray size is reached."));
   }
 
-  ecma_value_t new_arraybuffer_p = ecma_make_object_value (ecma_arraybuffer_new_object (byte_length));
+  ecma_object_t *arraybuffer_obj_p = ecma_arraybuffer_new_object (byte_length);
+
+  if (JERRY_UNLIKELY (arraybuffer_obj_p == NULL))
+  {
+    return ECMA_VALUE_ERROR;
+  }
+
+  ecma_value_t new_arraybuffer_p = ecma_make_object_value (arraybuffer_obj_p);
+
   ecma_object_t *object_p = ecma_create_object (proto_p,
                                                 sizeof (ecma_extended_object_t),
                                                 ECMA_OBJECT_TYPE_PSEUDO_ARRAY);

tests/jerry/fail/regression-test-issue-3130.js

@@ -0,0 +1,23 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var arrb = new ArrayBuffer(2147483648);
+var arr = new Uint8Array(arrb);
+
+try {
+    arr.copyWithin({}, 8);
+    assert(false);
+} catch (e) {
+    assert (e instanceof RangeError);
+}