From 7bbdc7e3da483d89cda12589bf90866472139aab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=88=B1=E7=89=B9=E6=AF=8F=E7=BE=8A=E9=98=9F?= Date: Wed, 17 Jun 2026 21:28:22 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E9=99=90=E5=88=B6=E5=86=85=E5=AD=98?= =?UTF-8?q?=E4=B8=8A=E9=99=90=E4=BB=A5=E5=87=8F=E7=BC=93=E6=B5=8B=E8=AF=95?= =?UTF-8?q?=E6=BA=A2=E5=87=BA=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- crates/oxide_vm/src/builtins/array_buffer.rs | 2 +- crates/oxide_vm/src/builtins/typed_array.rs | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/crates/oxide_vm/src/builtins/array_buffer.rs b/crates/oxide_vm/src/builtins/array_buffer.rs index 3ca8aeb..d09e45f 100644 --- a/crates/oxide_vm/src/builtins/array_buffer.rs +++ b/crates/oxide_vm/src/builtins/array_buffer.rs @@ -6,7 +6,7 @@ use crate::coercion; use crate::native::NativeResult; use crate::vm::Vm; -const MAX_ARRAY_BUFFER_LENGTH: usize = 1 << 30; +pub(crate) const MAX_ARRAY_BUFFER_LENGTH: usize = 1 << 30; macro_rules! native_try { ($expr:expr) => { diff --git a/crates/oxide_vm/src/builtins/typed_array.rs b/crates/oxide_vm/src/builtins/typed_array.rs index b62c890..b5ba1fe 100644 --- a/crates/oxide_vm/src/builtins/typed_array.rs +++ b/crates/oxide_vm/src/builtins/typed_array.rs @@ -2,7 +2,7 @@ use oxide_kernel::shape_forge::EMPTY_SHAPE_ID; use oxide_types::object::{JsObject, NativeFnPtr, PropAttributes, TypedArrayKind}; use oxide_types::value::JsValue; -use crate::builtins::array_buffer::{array_buffer_data_ptr, new_array_buffer}; +use crate::builtins::array_buffer::{array_buffer_data_ptr, new_array_buffer, MAX_ARRAY_BUFFER_LENGTH}; use crate::coercion; use crate::native::NativeResult; use crate::vm::Vm; @@ -224,6 +224,9 @@ fn typed_array_new(vm: &mut Vm, args: &[u8], kind: TypedArrayKind) -> NativeResu let Some(byte_len) = len.checked_mul(bpe) else { return NativeResult::Err(range_error(vm, "invalid TypedArray length")); }; + if byte_len > MAX_ARRAY_BUFFER_LENGTH { + return NativeResult::Err(range_error(vm, "invalid TypedArray length")); + } let buffer = JsValue::from_js_object(new_array_buffer(vm, vec![0; byte_len])); (buffer, 0, len) } else if first.is_object() {