| tiêu đề | quickjs-ng quickjs v0.11.0 Use After Free |
|---|
| Mô tả | A heap Use-After-Free (UAF) can be triggered in QuickJS-NG in js_atomics_store when coercing a user-supplied value executes arbitrary JS that resizes the underlying Resizable ArrayBuffer, invalidating a cached element pointer before the atomic write.
Root cause: js_atomics_store calls js_atomics_get_ptr, which caches a heap pointer (ptr) to the typed array element storage. During ret = JS_ToIntegerFree(...), side effects from arbitrary JS (e.g., valueOf) can resize the ArrayBuffer, moving/freeing the old backing store. The cached ptr becomes stale, and atomic_store((...)ptr, v); performs a write through a dangling pointer, causing a UAF.
Affected version: quickjs-ng/quickjs commit 537d004cd22b86373c262528c7e8076eaf76996d (tested on 2026-01-05).
Reproduction and ASAN crash details are publicly documented in: https://github.com/quickjs-ng/quickjs/issues/1301
Reporter credit: mcsky23 (Vlad Ionut Seba) |
|---|
| Nguồn | ⚠️ https://github.com/quickjs-ng/quickjs/issues/1301 |
|---|
| Người dùng | mcsky23 (UID 94179) |
|---|
| Đệ trình | 09/01/2026 19:55 (cách đây 9 các tháng) |
|---|
| Kiểm duyệt | 18/01/2026 14:43 (9 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 341737 [quickjs-ng quickjs đến 0.11.0 Atomics Ops quickjs.c tràn bộ đệm] |
|---|
| điểm | 20 |
|---|