facebook / facebook/hermes

JSParser hangs or crashes if Buffer object passed to prepareJavaScript is not followed by a one past the end null terminator

Open
#201 1 comment 0 reactions 1 assignee Claimed by @tmikov View on GitHub
enhancement
Dominant language
JavaScript
Stars
11.3k
Forks
859
Avg merge
1h 30m
Merged PRs (30d)
3

Description

If you run the following code

```c++
class VectorBuffer : public facebook::jsi::Buffer
{
public:
explicit VectorBuffer(std::vector data)
: _data(std::move(data))
{
// To force the bug to happen, insert a non-zero
// character after the buffer
_data.push_back(0x01);
}

virtual size_t size() const override { return _data.size() - 1; }
virtual const uint8_t* data() const override { return _data.data(); }

private:
std::vector _data;
};

int main()
{
static const uint8_t jscode[] = "console.log(\"hello\");";

hermes::vm::RuntimeConfig runtimeConfig;
auto runtime = facebook::hermes::makeHermesRuntime(runtimeConfig);

auto buffer = std::make_shared(std::vector(jscode, jscode + strlen((const char*)jscode)));
auto prepared = runtime->prepareJavaScript(buffer, "filename");

return 0;
}
```

Hermes v0.4.0 will hang inside JSLexer::advance with ```curCharPtr_``` equal to ```bufferEnd_ + 1```. Changing the value pushed after the data in the VectorBuffer constructor to zero will make it work.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.