JSParser hangs or crashes if Buffer object passed to prepareJavaScript is not followed by a one past the end null terminator
- Dominant language
- JavaScript
- Stars
- 11.3k
- Forks
- 859
- Avg merge
- 1h 30m
- Merged PRs (30d)
- 3
Description
If you run the following code
```c++
class VectorBuffer : public facebook::jsi::Buffer
{
public:
explicit VectorBuffer(std::vector data)
: _data(std::move(data))
{
// To force the bug to happen, insert a non-zero
// character after the buffer
_data.push_back(0x01);
}
virtual size_t size() const override { return _data.size() - 1; }
virtual const uint8_t* data() const override { return _data.data(); }
private:
std::vector _data;
};
int main()
{
static const uint8_t jscode[] = "console.log(\"hello\");";
hermes::vm::RuntimeConfig runtimeConfig;
auto runtime = facebook::hermes::makeHermesRuntime(runtimeConfig);
auto buffer = std::make_shared(std::vector(jscode, jscode + strlen((const char*)jscode)));
auto prepared = runtime->prepareJavaScript(buffer, "filename");
return 0;
}
```
Hermes v0.4.0 will hang inside JSLexer::advance with ```curCharPtr_``` equal to ```bufferEnd_ + 1```. Changing the value pushed after the data in the VectorBuffer constructor to zero will make it work.
Contributor guide
Assessment
This issue has not been assessed yet.