| タイトル | quickjs-ng quickjs v0.11.0 Heap-based Buffer Overflow |
|---|
| 説明 | A heap out-of-bounds access (buffer overflow) or Use-After-Free (UAF) can be triggered in QuickJS-NG in js_typed_array_constructor when constructing a typed array from another typed array using Reflect.construct with a malicious new_target whose prototype lookup executes arbitrary JS that resizes the underlying Resizable ArrayBuffer, invalidating a stale length used later during the element copy.
Root cause: When the constructor argument p is a typed array, js_typed_array_constructor takes the path: return js_typed_array_constructor_ta(..., p->u.array.count);. The value p->u.array.count (used as the length) is captured and remains stale inside js_typed_array_constructor_ta. During js_typed_array_constructor_ta, js_create_from_ctor performs a prototype property lookup on new_target, which can trigger arbitrary JS. If that JS resizes the backing ArrayBuffer, the previously captured len becomes invalid. The function then proceeds to copy using stale assumptions, leading to an overflow/UAF at: memcpy(abuf->data, src_abuf->data + ta->offset, abuf->byte_length);.
Affected version: quickjs-ng/quickjs commit 537d004cd22b86373c262528c7e8076eaf76996d (tested on 2026-01-05).
Reproduction and ASAN crash details are publicly documented in: https://github.com/quickjs-ng/quickjs/issues/1305
Reporter credit: mcsky23 (Vlad Ionut Seba) |
|---|
| ソース | ⚠️ https://github.com/quickjs-ng/quickjs/issues/1305 |
|---|
| ユーザー | mcsky23 (UID 94179) |
|---|
| 送信 | 2026年01月09日 20:04 (9 月 ago) |
|---|
| モデレーション | 2026年01月18日 14:43 (9 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 341738 [quickjs-ng quickjs 迄 0.11.0 quickjs.c js_typed_array_constructor_ta メモリ破損] |
|---|
| ポイント | 20 |
|---|