From 94fd52dbb83a4982e4a70e621f431b0bd0945b5d Mon Sep 17 00:00:00 2001 From: Fabian Kosmale Date: Wed, 12 Oct 2022 09:02:40 +0200 Subject: QV4: Avoid memory corruption in Reflect.apply This extracts the check from Function.prototype.apply into a shared function, and uses it in Reflect.apply, which has the same issue. Task-number: QTBUG-107619 Change-Id: I899464c86554f9bbb5270a95bbe3fe27531e9a27 Reviewed-by: Ulf Hermann (cherry picked from commit 0e963a53c04b0dbe172cfb495b4d62dc8e2f31a3) Reviewed-by: Qt Cherry-pick Bot --- src/qml/jsruntime/qv4functionobject.cpp | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) (limited to 'src/qml/jsruntime/qv4functionobject.cpp') diff --git a/src/qml/jsruntime/qv4functionobject.cpp b/src/qml/jsruntime/qv4functionobject.cpp index 987355286d..efb4a10f11 100644 --- a/src/qml/jsruntime/qv4functionobject.cpp +++ b/src/qml/jsruntime/qv4functionobject.cpp @@ -364,15 +364,10 @@ ReturnedValue FunctionPrototype::method_apply(const QV4::FunctionObject *b, cons if (!arr) return v4->throwTypeError(); - const qint64 len64 = arr->getLength(); - if (len64 < 0ll || len64 > qint64(std::numeric_limits::max())) - return v4->throwRangeError(QStringLiteral("Invalid array length.")); - if (len64 > qint64(v4->jsStackLimit - v4->jsStackTop)) - return v4->throwRangeError(QStringLiteral("Array too large for apply().")); - - const uint len = uint(len64); - Scope scope(v4); + const uint len = v4->safeForAllocLength(arr->getLength()); + CHECK_EXCEPTION(); + Value *arguments = scope.alloc(len); if (len) { if (ArgumentsObject::isNonStrictArgumentsObject(arr) && !arr->cast()->fullyCreated()) { -- cgit v1.2.3