Fix signed integer overflow in jvp_array_write and jvp_object_rehash
This commit fixes signed integer overflow and SEGV issues on growing arrays and objects. The size of arrays and objects is now limited to `536870912` (`0x20000000`). This fixes CVE-2024-23337 and fixes #3262.
This commit is contained in:
1 parent
4e2ccc4c9b
commit
de21386681
3 files changed
+45
-13
No files matched your search
@@ -226,6 +226,10 @@ null
|
||||
[0,1,2]
|
||||
[0,5,2]
|
||||
|
||||
try (.[999999999] = 0) catch .
|
||||
null
|
||||
"Array index too large"
|
||||
|
||||
#
|
||||
# Multiple outputs, iteration
|
||||
#
|
||||
|
||||
Reference in new issue
Block a user