From 9ce544289fe86acdb8fb33e6a425da151438be05 Mon Sep 17 00:00:00 2001 From: Fabrice Bellard Date: Mon, 25 Aug 2025 15:06:19 +0200 Subject: [PATCH] fixed buffer overflow in js_bigint_to_string1() --- quickjs.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/quickjs.c b/quickjs.c index 29fd830..994f032 100644 --- a/quickjs.c +++ b/quickjs.c @@ -11997,11 +11997,10 @@ static JSValue js_bigint_to_string1(JSContext *ctx, JSValueConst val, int radix) bit_pos = i * log2_radix; pos = bit_pos / JS_LIMB_BITS; shift = bit_pos % JS_LIMB_BITS; - if (likely((shift + log2_radix) <= JS_LIMB_BITS)) { - c = r->tab[pos] >> shift; - } else { - c = (r->tab[pos] >> shift) | - (r->tab[pos + 1] << (JS_LIMB_BITS - shift)); + c = r->tab[pos] >> shift; + if ((shift + log2_radix) > JS_LIMB_BITS && + (pos + 1) < r->len) { + c |= r->tab[pos + 1] << (JS_LIMB_BITS - shift); } c &= (radix - 1); *--q = digits[c];