Commit 7ac126b
src: fix out-of-bounds check of serialization indices
The usage of `CHECK_LE` to verify that the index is within bounds
of a vector's size allows for reading one item past the vector's end,
which is in invalid memory read. This commit fixes the off-by-one error
by changing the bounds check to use `CHECK_LT`.
PR-URL: #41452
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>1 parent 5c0c459 commit 7ac126b
1 file changed
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -98,19 +98,19 @@ class DeserializerDelegate : public ValueDeserializer::Delegate { | |||
| 98 | 98 | uint32_t id; | |
| 99 | 99 | if (!deserializer->ReadUint32(&id)) | |
| 100 | 100 | return MaybeLocal<Object>(); | |
| 101 | - CHECK_LE(id, host_objects_.size()); | ||
| 101 | + CHECK_LT(id, host_objects_.size()); | ||
| 102 | 102 | return host_objects_[id]->object(isolate); | |
| 103 | 103 | } | |
| 104 | 104 | ||
| 105 | 105 | MaybeLocal<SharedArrayBuffer> GetSharedArrayBufferFromId( | |
| 106 | 106 | Isolate* isolate, uint32_t clone_id) override { | |
| 107 | - CHECK_LE(clone_id, shared_array_buffers_.size()); | ||
| 107 | + CHECK_LT(clone_id, shared_array_buffers_.size()); | ||
| 108 | 108 | return shared_array_buffers_[clone_id]; | |
| 109 | 109 | } | |
| 110 | 110 | ||
| 111 | 111 | MaybeLocal<WasmModuleObject> GetWasmModuleFromId( | |
| 112 | 112 | Isolate* isolate, uint32_t transfer_id) override { | |
| 113 | - CHECK_LE(transfer_id, wasm_modules_.size()); | ||
| 113 | + CHECK_LT(transfer_id, wasm_modules_.size()); | ||
| 114 | 114 | return WasmModuleObject::FromCompiledModule( | |
| 115 | 115 | isolate, wasm_modules_[transfer_id]); | |
| 116 | 116 | } | |
0 commit comments