mirrors/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity.git synced 2025-01-24 02:12:09 -05:00
Code Issues Projects Releases Packages Wiki Activity

LibJS: GlobalObject must mark builtin prototypes

Browse source 
Failing to mark them leads to use-after-free since the GlobalObject
cached prototypes are used for new NumberObject, StringObject, etc.

Found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30319
This commit is contained in:
Andreas Kling 2021-02-05 14:51:18 +01:00
parent 0269578d3e
commit 7df3b95126
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Userland/Libraries/LibJS/Runtime/GlobalObject.cpp
View file

@ -167,8 +167,10 @@ void GlobalObject::visit_edges(Visitor& visitor)
visitor.visit(m_proxy_constructor);
#define __JS_ENUMERATE(ClassName, snake_name, PrototypeName, ConstructorName, ArrayType) \
visitor.visit(m_##snake_name##_constructor);
visitor.visit(m_##snake_name##_constructor); \
visitor.visit(m_##snake_name##_prototype);
JS_ENUMERATE_ERROR_SUBCLASSES
JS_ENUMERATE_BUILTIN_TYPES
#undef __JS_ENUMERATE
#define __JS_ENUMERATE(ClassName, snake_name) \