Fix signed integer overflow in jvp_array_write and jvp_object_rehash

This commit fixes signed integer overflow and SEGV issues on growing
arrays and objects. The size of arrays and objects is now limited to
`536870912` (`0x20000000`). This fixes CVE-2024-23337 and fixes #3262.
This commit is contained in:
itchyny committed 2025-05-21 07:48:23 +09:00
1 parent 4e2ccc4c9b
commit de21386681
3 files changed
+45 -13

No files matched your search

+4
View File
@@ -226,6 +226,10 @@ null
[0,1,2]
[0,5,2]
try (.[999999999] = 0) catch .
null
"Array index too large"
#
# Multiple outputs, iteration
#