From: Fabrice Bellard <fabrice@bellard.org>
Date: Mon, 7 Apr 2025 16:40:49 +0000 (+0200)
Subject: fixed buffer overflow in BJSON String and BigInt reader (#399)
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/static/gitweb.js?a=commitdiff_plain;h=1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a;p=quickjs.git

fixed buffer overflow in BJSON String and BigInt reader (#399)
---

diff --git a/quickjs.c b/quickjs.c
index 9be262e..b2470ba 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -35564,6 +35564,10 @@ static JSString *JS_ReadString(BCReaderState *s)
         return NULL;
     is_wide_char = len & 1;
     len >>= 1;
+    if (len > JS_STRING_LEN_MAX) {
+        JS_ThrowInternalError(s->ctx, "string too long");
+        return NULL;
+    }
     p = js_alloc_string(s->ctx, len, is_wide_char);
     if (!p) {
         s->error_state = -1;
@@ -35675,8 +35679,7 @@ static JSValue JS_ReadBigInt(BCReaderState *s)
         bc_read_trace(s, "}\n");
         return __JS_NewShortBigInt(s->ctx, 0);
     }
-    p = js_bigint_new(s->ctx,
-                      (len + (JS_LIMB_BITS / 8) - 1) / (JS_LIMB_BITS / 8));
+    p = js_bigint_new(s->ctx, (len - 1) / (JS_LIMB_BITS / 8) + 1);
     if (!p)
         goto fail;
     for(i = 0; i < len / (JS_LIMB_BITS / 8); i++) {