Fixed the security issue

Issue:https://gitee.com/openharmony/arkcompiler_ets_runtime/issues/IAIZI1

Signed-off-by: 王笑佳 <wangxiaojia5@huawei.com>
This commit is contained in:
王笑佳 2024-10-10 20:14:49 +08:00
parent 00e623a192
commit 1748d32770
9 changed files with 73 additions and 1 deletions

View File

@ -246,6 +246,10 @@ bool JSAPILinkedList::GetOwnProperty(JSThread *thread, const JSHandle<JSAPILinke
}
JSHandle<TaggedDoubleList> doubleList(thread, list->GetDoubleList());
uint32_t length = static_cast<uint32_t>(doubleList->Length());
if (length == 0) {
JSTaggedValue error = ContainerError::BusinessError(thread, ErrorFlag::RANGE_ERROR, "Container is empty");
THROW_NEW_ERROR_AND_RETURN_VALUE(thread, error, false);
}
if (index >= length) {
ASSERT(length > 0);
std::ostringstream oss;

View File

@ -198,6 +198,10 @@ bool JSAPIPlainArray::GetOwnProperty(JSThread *thread, const JSHandle<JSAPIPlain
{
TaggedArray *keyArray = TaggedArray::Cast(obj->GetKeys().GetTaggedObject());
uint32_t size = obj->GetLength();
if (size == 0) {
JSTaggedValue error = ContainerError::BusinessError(thread, ErrorFlag::RANGE_ERROR, "Container is empty");
THROW_NEW_ERROR_AND_RETURN_VALUE(thread, error, false);
}
int32_t index = obj->BinarySearch(keyArray, 0, size, key.GetTaggedValue().GetInt());
if (index < 0 || index >= static_cast<int32_t>(size)) {
ASSERT(size > 0);

View File

@ -206,6 +206,10 @@ bool JSAPIQueue::GetOwnProperty(JSThread *thread, const JSHandle<JSAPIQueue> &ob
}
uint32_t length = obj->GetLength().GetArrayLength();
if (length == 0) {
JSTaggedValue error = ContainerError::BusinessError(thread, ErrorFlag::RANGE_ERROR, "Container is empty");
THROW_NEW_ERROR_AND_RETURN_VALUE(thread, error, false);
}
if (index >= length) {
ASSERT(length > 0);
std::ostringstream oss;

View File

@ -154,6 +154,10 @@ bool JSAPIStack::GetOwnProperty(JSThread *thread, const JSHandle<JSAPIStack> &ob
}
uint32_t length = static_cast<uint32_t>(obj->GetTop() + 1);
if (length == 0) {
JSTaggedValue error = ContainerError::BusinessError(thread, ErrorFlag::RANGE_ERROR, "Container is empty");
THROW_NEW_ERROR_AND_RETURN_VALUE(thread, error, false);
}
if (index >= length) {
std::ostringstream oss;
ASSERT(length > 0);

View File

@ -370,7 +370,19 @@ if (globalThis["ArkPrivate"] != undefined) {
} else {
print("Test LinkedList fail: " + flag);
}
const v6 = new LinkedList()
function f2(a3) {
return a3
}
const o5 = {
"get" : f2,
}
const v7 = new Proxy(v6, o5)
try {
v7[1073741823]
} catch (error) {
print(error)
}
let mList = new LinkedList();
for (let i = 1; i <= 10; ++i) {
mList.add(i);

View File

@ -192,5 +192,18 @@ if (globalThis["ArkPrivate"] != undefined) {
} else {
print("Test PlainArray fail: " + res);
}
const v6 = new PlainArray()
function f2(a3) {
return a3
}
const o5 = {
"get" : f2,
}
const v7 = new Proxy(v6, o5)
try {
v7[1073741823]
} catch (error) {
print(error)
}
}
export let plainarrayRes = "Test PlainArray done";

View File

@ -149,5 +149,18 @@ if (globalThis["ArkPrivate"] != undefined) {
} catch(error) {
print(error);
}
const v6 = new Queue()
function f2(a3) {
return a3
}
const o5 = {
"get" : f2,
}
const v7 = new Proxy(v6, o5)
try {
v7[1073741823]
} catch (error) {
print(error)
}
}
export let queueRes = "Test Queue done";

View File

@ -143,5 +143,19 @@ if (globalThis["ArkPrivate"] != undefined) {
} catch (error) {
print(error)
}
const v6 = new Stack()
function f2(a3) {
return a3
}
const o5 = {
"get" : f2,
}
const v7 = new Proxy(v6, o5)
try {
v7[1073741823]
} catch (error) {
print(error)
}
}
export let stackRes = "Test Stack done";

View File

@ -24,15 +24,19 @@ Test HashSet success!!!
Test LightWeightMap success!!!
Test LightWeightSet success!!!
Test LinkedList success!!!
BusinessError: Container is empty
0
Test List success!!!
Test PlainArray success!!!
BusinessError: Container is empty
0
Test Queue success!!!
6
BusinessError: Container is empty
BusinessError: Container is empty
Test Stack success!!!
BusinessError: Container is empty
BusinessError: Container is empty
Test TreeMap success!!!
Test TreeMap set After Clear Success
Test TreeSet success!!!