Bug 254331
| Summary: | Aborted at Source/JavaScriptCore/runtime/ArrayBuffer.cpp(113) | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | xiangwei1895 |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | mark.lam, msaboff, ysuzuki |
| Priority: | P2 | ||
| Version: | WebKit Local Build | ||
| Hardware: | PC | ||
| OS: | Linux | ||
xiangwei1895
my JSC crashed when executing the following code：
PoC：
const v2 = new Int16Array(59925);
function f3(a4, a5, a6, a7) {
const o10 = {
"maxByteLength": 786701,
};
const v12 = new ArrayBuffer(32, o10);
return a6;
}
v2.forEach(f3);
mprotect failed: Cannot allocate memory
SHOULD NEVER BE REACHED
/home/data/WebKit/Source/JavaScriptCore/runtime/ArrayBuffer.cpp(113) : WTF::RefPtr<JSC::BufferMemoryHandle> JSC::tryAllocateResizableMemory(VM*, size_t, size_t)
Aborted (core dumped)
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Alexey Proskuryakov
On macOS Apple Silicon, I get an exception and no crash.
>>> const v2 = new Int16Array(59925);
undefined
>>> function f3(a4, a5, a6, a7) {
... const o10 = {
... "maxByteLength": 786701,
... };
... const v12 = new ArrayBuffer(32, o10);
... return a6;
... }
undefined
>>> v2.forEach(f3);
Exception: RangeError: Out of memory
>>>
Yusuke Suzuki
This is memory exhaustion on Linux platform, and RELEASE_ASSERT_NOT_REACHED. Thus, not a security issue.