From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Thu, 24 Sep 2026 22:53:56 +0000 (-0700)
Subject: Buffer: free QJS buffers on conversion failures
X-Git-Tag: 1.0.2~19
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=6a6e7f404a642f23fcb61b4d928eb14b7466326c;p=njs.git

Buffer: free QJS buffers on conversion failures

qjs_buffer_from_string() and qjs_buffer_create() leaked the newly
allocated buffer when qjs_typed_array_data() or string decoding failed.

Also check the JS_ToCStringLen() result in qjs_buffer_from_string(), so
an allocation failure is not followed by a NULL pointer dereference.
---

diff --git a/src/qjs_buffer.c b/src/qjs_buffer.c
index 65c57216..2eb12e3a 100644
--- a/src/qjs_buffer.c
+++ b/src/qjs_buffer.c
@@ -1890,6 +1890,9 @@ qjs_buffer_from_string(JSContext *ctx, JSValueConst str,
     }
 
     src.start = (u_char *) JS_ToCStringLen(ctx, &src.length, str);
+    if (src.start == NULL) {
+        return JS_EXCEPTION;
+    }
 
     if (encoding->decode_length != NULL) {
         size = encoding->decode_length(ctx, &src);
@@ -1907,12 +1910,14 @@ qjs_buffer_from_string(JSContext *ctx, JSValueConst str,
     ret = qjs_typed_array_data(ctx, buffer, &dst);
     if (JS_IsException(ret)) {
         JS_FreeCString(ctx, (char *) src.start);
+        JS_FreeValue(ctx, buffer);
         return ret;
     }
 
     if (encoding->decode != NULL) {
         if (encoding->decode(ctx, &src, &dst) != 0) {
             JS_FreeCString(ctx, (char *) src.start);
+            JS_FreeValue(ctx, buffer);
             JS_ThrowTypeError(ctx, "failed to decode string");
             return JS_EXCEPTION;
         }
@@ -2613,6 +2618,7 @@ qjs_buffer_create(JSContext *ctx, u_char *start, size_t size)
 
     ret = qjs_typed_array_data(ctx, buffer, &dst);
     if (JS_IsException(ret)) {
+        JS_FreeValue(ctx, buffer);
         return ret;
     }