Skip to content

Fix TypedArray.slice with external array buffer #3080

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

galpeter
Copy link
Contributor

@galpeter galpeter commented Sep 6, 2019

In case of TypedArrays which were constructed with an ArrayBuffer
the slice method incorrectly added the byteOffset value of
when the elements were copied.

There is no need to add the byteOffset value for the ArrayBuffer's
contents pointer as it is already added by the ecma_typedarray_get_buffer
call.

Fixes: #3078

In case of TypedArrays which were constructed with an ArrayBuffer
the `slice` method incorrectly added the `byteOffset` value of
when the elements were copied.

There is no need to add the `byteOffset` value for the ArrayBuffer's
contents pointer as it is already added by the `ecma_typedarray_get_buffer`
call.

JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
@galpeter galpeter added bug Undesired behaviour ecma builtins Related to ECMA built-in routines ES2015 Related to ES2015 features labels Sep 6, 2019
@galpeter galpeter assigned rerobika and unassigned rerobika Sep 6, 2019
@galpeter galpeter requested a review from rerobika September 6, 2019 12:12
Copy link
Member

@rerobika rerobika left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Member

@dbatyai dbatyai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dbatyai dbatyai merged commit 5d51fe8 into jerryscript-project:master Sep 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Undesired behaviour ecma builtins Related to ECMA built-in routines ES2015 Related to ES2015 features
Projects
None yet
Development

Successfully merging this pull request may close these issues.

heap-buffer-overflow in ecma_builtin_typedarray_prototype_slice
3 participants