Welcome! Log In Create A New Profile

Advanced

[njs] Fixed integer overflow in njs_typed_array_constructor().

Dmitry Volyntsev
January 09, 2020 07:56AM
details: https://hg.nginx.org/njs/rev/aa9a42bfc727
branches:
changeset: 1296:aa9a42bfc727
user: Dmitry Volyntsev <xeioex@nginx.com>
date: Thu Jan 09 15:54:52 2020 +0300
description:
Fixed integer overflow in njs_typed_array_constructor().

Found by Coverity (CID 1457371).

diffstat:

src/njs_typed_array.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diffs (12 lines):

diff -r 4e3c2f9e4eee -r aa9a42bfc727 src/njs_typed_array.c
--- a/src/njs_typed_array.c Thu Jan 09 15:54:16 2020 +0300
+++ b/src/njs_typed_array.c Thu Jan 09 15:54:52 2020 +0300
@@ -85,7 +85,7 @@ njs_typed_array_constructor(njs_vm_t *vm

} else if (njs_is_typed_array(value)) {
src_tarray = njs_typed_array(value);
- size = njs_typed_array_length(src_tarray) * element_size;
+ size = (uint64_t) njs_typed_array_length(src_tarray) * element_size;

} else if (njs_is_object(value)) {
if (njs_is_array(value) && njs_object_hash_is_empty(value)) {
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[njs] Fixed integer overflow in njs_typed_array_constructor().

Dmitry Volyntsev 69 January 09, 2020 07:56AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 79
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready