AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[rab/gsab] Fix ValueSerializer RAB / GSAB support

Browse Source 
The "is there enough data" check has to be done *after* reading
maxByteLength.

Bug: v8:11111, chromium:1400431
Change-Id: I7c2eddaeb998f3cd3919e118c093a5d036fca408
Fixed: chromium:1400431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100468
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84809}
This commit is contained in:
Marja Hölttä 2022-12-13 11:36:30 +01:00 committed by V8 LUCI CQ
parent e1e08901c2
commit d873ac4b15
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/objects/value-serializer.cc
View File

@ -2031,8 +2031,7 @@ MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer(
return array_buffer;
}
uint32_t byte_length;
if (!ReadVarint<uint32_t>().To(&byte_length) ||
byte_length > static_cast<size_t>(end_ - position_)) {
if (!ReadVarint<uint32_t>().To(&byte_length)) {
return MaybeHandle<JSArrayBuffer>();
}
uint32_t max_byte_length = byte_length;
@ -2051,6 +2050,9 @@ MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer(
max_byte_length = byte_length;
}
}
if (byte_length > static_cast<size_t>(end_ - position_)) {
return MaybeHandle<JSArrayBuffer>();
}
MaybeHandle<JSArrayBuffer> result =
isolate_->factory()->NewJSArrayBufferAndBackingStore(
byte_length, max_byte_length, InitializedFlag::kUninitialized,

7
test/unittests/objects/value-serializer-unittest.cc
View File

@ -1952,6 +1952,13 @@ TEST_F(ValueSerializerTest, DecodeInvalidArrayBuffer) {
InvalidDecodeTest({0xFF, 0x09, 0x42, 0xFF, 0xFF, 0x00});
}
TEST_F(ValueSerializerTest, DecodeInvalidResizableArrayBuffer) {
FLAG_SCOPE(harmony_rab_gsab);
// Enough bytes available after reading the length, but not anymore when
// reading the max byte length.
InvalidDecodeTest({0xFF, 0x09, 0x7E, 0x2, 0x10, 0x00});
}
// An array buffer allocator that never has available memory.
class OOMArrayBufferAllocator : public ArrayBuffer::Allocator {
public: