commit 590e37060ca6c5af2498d5f38feb546263d7b4b7
parent e37429d4d58aab0316ac7e5b5017fb5a02e19eed
Author: Charlie Gordon <github@chqrlie.org>
Date: Sun, 11 Feb 2024 12:49:40 +0100
Fix runtime bugs
- fix string leak in `js_printf_internal` on errors
- read `errno` before potential side effects in `js_os_stat`
Diffstat:
2 files changed, 21 insertions(+), 22 deletions(-)
diff --git a/quickjs/quickjs-libc.c b/quickjs/quickjs-libc.c
@@ -212,7 +212,7 @@ static JSValue js_printf_internal(JSContext *ctx,
uint8_t cbuf[UTF8_CHAR_LEN_MAX+1];
JSValue res;
DynBuf dbuf;
- const char *fmt_str;
+ const char *fmt_str = NULL;
const uint8_t *fmt, *fmt_end;
const uint8_t *p;
char *q;
@@ -313,7 +313,7 @@ static JSValue js_printf_internal(JSContext *ctx,
string_arg = JS_ToCString(ctx, argv[i++]);
if (!string_arg)
goto fail;
- int32_arg = unicode_from_utf8((uint8_t *)string_arg, UTF8_CHAR_LEN_MAX, &p);
+ int32_arg = unicode_from_utf8((const uint8_t *)string_arg, UTF8_CHAR_LEN_MAX, &p);
JS_FreeCString(ctx, string_arg);
} else {
if (JS_ToInt32(ctx, &int32_arg, argv[i++]))
@@ -417,6 +417,7 @@ static JSValue js_printf_internal(JSContext *ctx,
return res;
fail:
+ JS_FreeCString(ctx, fmt_str);
dbuf_free(&dbuf);
return JS_EXCEPTION;
}
@@ -1750,7 +1751,7 @@ static JSValue js_os_seek(JSContext *ctx, JSValueConst this_val,
}
static JSValue js_os_read_write(JSContext *ctx, JSValueConst this_val,
- int argc, JSValueConst *argv, int magic)
+ int argc, JSValueConst *argv, int magic)
{
int fd;
uint64_t pos, len;
@@ -1891,7 +1892,7 @@ static JSValue js_os_ttySetRaw(JSContext *ctx, JSValueConst this_val,
#endif /* !_WIN32 */
static JSValue js_os_remove(JSContext *ctx, JSValueConst this_val,
- int argc, JSValueConst *argv)
+ int argc, JSValueConst *argv)
{
const char *filename;
int ret;
@@ -3235,12 +3236,14 @@ static JSValue js_os_stat(JSContext *ctx, JSValueConst this_val,
else
res = stat(path, &st);
#endif
+ if (res < 0)
+ err = errno;
+ else
+ err = 0;
JS_FreeCString(ctx, path);
if (res < 0) {
- err = errno;
obj = JS_NULL;
} else {
- err = 0;
obj = JS_NewObject(ctx);
if (JS_IsException(obj))
return JS_EXCEPTION;
@@ -3351,7 +3354,7 @@ static JSValue js_os_utimes(JSContext *ctx, JSValueConst this_val,
/* sleep(delay_ms) */
static JSValue js_os_sleep(JSContext *ctx, JSValueConst this_val,
- int argc, JSValueConst *argv)
+ int argc, JSValueConst *argv)
{
int64_t delay;
int ret;
@@ -3415,7 +3418,7 @@ static JSValue js_os_realpath(JSContext *ctx, JSValueConst this_val,
#if !defined(_WIN32)
static JSValue js_os_symlink(JSContext *ctx, JSValueConst this_val,
- int argc, JSValueConst *argv)
+ int argc, JSValueConst *argv)
{
const char *target, *linkpath;
int err;
@@ -4673,7 +4676,7 @@ JSModuleDef *js_init_module_os(JSContext *ctx, const char *module_name)
/**********************************************************/
static JSValue js_print(JSContext *ctx, JSValueConst this_val,
- int argc, JSValueConst *argv)
+ int argc, JSValueConst *argv)
{
int i;
const char *str;
diff --git a/quickjs/quickjs.c b/quickjs/quickjs.c
@@ -601,7 +601,7 @@ typedef struct JSFunctionBytecode {
uint8_t backtrace_barrier : 1; /* stop backtrace on this function */
uint8_t read_only_bytecode : 1;
uint8_t is_direct_or_indirect_eval : 1; /* used by JS_GetScriptOrModuleName() */
- /* XXX: 4 bits available */
+ /* XXX: 10 bits available */
uint8_t *byte_code_buf; /* (self pointer) */
int byte_code_len;
JSAtom func_name;
@@ -1046,13 +1046,11 @@ static JSValue JS_EvalObject(JSContext *ctx, JSValueConst this_obj,
JSValueConst val, int flags, int scope_idx);
JSValue __attribute__((format(printf, 2, 3))) JS_ThrowInternalError(JSContext *ctx, const char *fmt, ...);
static __maybe_unused void JS_DumpAtoms(JSRuntime *rt);
-static __maybe_unused void JS_DumpString(JSRuntime *rt,
- const JSString *p);
+static __maybe_unused void JS_DumpString(JSRuntime *rt, const JSString *p);
static __maybe_unused void JS_DumpObjectHeader(JSRuntime *rt);
static __maybe_unused void JS_DumpObject(JSRuntime *rt, JSObject *p);
static __maybe_unused void JS_DumpGCObject(JSRuntime *rt, JSGCObjectHeader *p);
-static __maybe_unused void JS_DumpValueShort(JSRuntime *rt,
- JSValueConst val);
+static __maybe_unused void JS_DumpValueShort(JSRuntime *rt, JSValueConst val);
static __maybe_unused void JS_DumpValue(JSContext *ctx, JSValueConst val);
static __maybe_unused void JS_PrintValue(JSContext *ctx,
const char *str,
@@ -1061,14 +1059,11 @@ static __maybe_unused void JS_DumpShapes(JSRuntime *rt);
static JSValue js_function_apply(JSContext *ctx, JSValueConst this_val,
int argc, JSValueConst *argv, int magic);
static void js_array_finalizer(JSRuntime *rt, JSValue val);
-static void js_array_mark(JSRuntime *rt, JSValueConst val,
- JS_MarkFunc *mark_func);
+static void js_array_mark(JSRuntime *rt, JSValueConst val, JS_MarkFunc *mark_func);
static void js_object_data_finalizer(JSRuntime *rt, JSValue val);
-static void js_object_data_mark(JSRuntime *rt, JSValueConst val,
- JS_MarkFunc *mark_func);
+static void js_object_data_mark(JSRuntime *rt, JSValueConst val, JS_MarkFunc *mark_func);
static void js_c_function_finalizer(JSRuntime *rt, JSValue val);
-static void js_c_function_mark(JSRuntime *rt, JSValueConst val,
- JS_MarkFunc *mark_func);
+static void js_c_function_mark(JSRuntime *rt, JSValueConst val, JS_MarkFunc *mark_func);
static void js_bytecode_function_finalizer(JSRuntime *rt, JSValue val);
static void js_bytecode_function_mark(JSRuntime *rt, JSValueConst val,
JS_MarkFunc *mark_func);
@@ -4194,7 +4189,7 @@ static JSValue JS_ConcatString1(JSContext *ctx,
return JS_MKPTR(JS_TAG_STRING, p);
}
-/* op1 and op2 are converted to strings. For convience, op1 or op2 =
+/* op1 and op2 are converted to strings. For convenience, op1 or op2 =
JS_EXCEPTION are accepted and return JS_EXCEPTION. */
static JSValue JS_ConcatString(JSContext *ctx, JSValue op1, JSValue op2)
{
@@ -17172,6 +17167,7 @@ static JSValue __JS_CallInternal(JSContext *caller_ctx, JSValueConst func_obj,
op1 = sp[-1];
pc += 4;
+ /* quick and dirty test for JS_TAG_INT, JS_TAG_BOOL, JS_TAG_NULL and JS_TAG_UNDEFINED */
if ((uint32_t)JS_VALUE_GET_TAG(op1) <= JS_TAG_UNDEFINED) {
res = JS_VALUE_GET_INT(op1);
} else {
@@ -50807,7 +50803,7 @@ static JSValue JS_ToBigIntCtorFree(JSContext *ctx, JSValue val)
#ifdef CONFIG_BIGNUM
case JS_TAG_BIG_DECIMAL:
val = JS_ToStringFree(ctx, val);
- if (JS_IsException(val))
+ if (JS_IsException(val))
break;
goto redo;
#endif
