fries/quickjs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix UB nullptr passing to memcpy()

Browse source
This commit is contained in:
Ben Noordhuis 2023-11-01 04:55:30 +01:00
parent 8217c69157
commit a9957cdcee
4 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
cutils.c
View file

@ -140,8 +140,10 @@ int dbuf_put(DynBuf *s, const uint8_t *data, size_t len)
if (dbuf_realloc(s, s->size + len))
return -1;
}
memcpy(s->buf + s->size, data, len);
s->size += len;
if (len > 0) {
memcpy(s->buf + s->size, data, len);
s->size += len;
}
return 0;
}

3
libbf.c
View file

@ -292,7 +292,8 @@ int bf_set(bf_t *r, const bf_t *a)
}
r->sign = a->sign;
r->expn = a->expn;
memcpy(r->tab, a->tab, a->len * sizeof(limb_t));
if (a->len > 0)
memcpy(r->tab, a->tab, a->len * sizeof(limb_t));
return 0;
}

3
quickjs-libc.c
View file

@ -3462,7 +3462,8 @@ static JSValue js_worker_postMessage(JSContext *ctx, JSValueConst this_val,
msg->sab_tab = malloc(sizeof(msg->sab_tab[0]) * sab_tab_len);
if (!msg->sab_tab)
goto fail;
memcpy(msg->sab_tab, sab_tab, sizeof(msg->sab_tab[0]) * sab_tab_len);
if (sab_tab_len > 0)
memcpy(msg->sab_tab, sab_tab, sizeof(msg->sab_tab[0]) * sab_tab_len);
msg->sab_tab_len = sab_tab_len;
js_free(ctx, data);

6
quickjs.c
View file

@ -32595,8 +32595,10 @@ static JSValue js_create_function(JSContext *ctx, JSFunctionDef *fd)
}
} else {
b->vardefs = (void *)((uint8_t*)b + vardefs_offset);
memcpy(b->vardefs, fd->args, fd->arg_count * sizeof(fd->args[0]));
memcpy(b->vardefs + fd->arg_count, fd->vars, fd->var_count * sizeof(fd->vars[0]));
if (fd->arg_count > 0)
memcpy(b->vardefs, fd->args, fd->arg_count * sizeof(fd->args[0]));
if (fd->var_count > 0)
memcpy(b->vardefs + fd->arg_count, fd->vars, fd->var_count * sizeof(fd->vars[0]));
}
b->var_count = fd->var_count;
b->arg_count = fd->arg_count;