From 6a6e7f404a642f23fcb61b4d928eb14b7466326c Mon Sep 17 00:00:00 2001 From: Dmitry Volyntsev Date: Thu, 24 Sep 2026 15:53:56 -0700 Subject: [PATCH] Buffer: free QJS buffers on conversion failures qjs_buffer_from_string() and qjs_buffer_create() leaked the newly allocated buffer when qjs_typed_array_data() or string decoding failed. Also check the JS_ToCStringLen() result in qjs_buffer_from_string(), so an allocation failure is not followed by a NULL pointer dereference. --- src/qjs_buffer.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/qjs_buffer.c b/src/qjs_buffer.c index 65c57216..2eb12e3a 100644 --- a/src/qjs_buffer.c +++ b/src/qjs_buffer.c @@ -1890,6 +1890,9 @@ qjs_buffer_from_string(JSContext *ctx, JSValueConst str, } src.start = (u_char *) JS_ToCStringLen(ctx, &src.length, str); + if (src.start == NULL) { + return JS_EXCEPTION; + } if (encoding->decode_length != NULL) { size = encoding->decode_length(ctx, &src); @@ -1907,12 +1910,14 @@ qjs_buffer_from_string(JSContext *ctx, JSValueConst str, ret = qjs_typed_array_data(ctx, buffer, &dst); if (JS_IsException(ret)) { JS_FreeCString(ctx, (char *) src.start); + JS_FreeValue(ctx, buffer); return ret; } if (encoding->decode != NULL) { if (encoding->decode(ctx, &src, &dst) != 0) { JS_FreeCString(ctx, (char *) src.start); + JS_FreeValue(ctx, buffer); JS_ThrowTypeError(ctx, "failed to decode string"); return JS_EXCEPTION; } @@ -2613,6 +2618,7 @@ qjs_buffer_create(JSContext *ctx, u_char *start, size_t size) ret = qjs_typed_array_data(ctx, buffer, &dst); if (JS_IsException(ret)) { + JS_FreeValue(ctx, buffer); return ret; } -- 2.47.3