Skip to content

Fix leak in JS_ReadBigInt on truncated input - #578

Closed
theaddonn wants to merge 1 commit into
bellard:masterfrom
theaddonn:fix-bigint-read-leak
Closed

theaddonn wants to merge 1 commit into
bellard:masterfrom
theaddonn:fix-bigint-read-leak

Conversation

@theaddonn

Copy link
Copy Markdown

If the input ends partway through a bigint, the fail path freed an unused obj but not the bigint. Shows up under ASan with the added test.

Port of quickjs-ng/quickjs#1840

JS_ReadBigInt allocates the bigint before reading its limbs. If the
input ended partway through, the fail path freed an unused `obj`
variable but not the bigint.

Free the bigint instead and drop the dead variable.

Port of quickjs-ng/quickjs#1840
@bellard

bellard commented Oct 26, 2026

Copy link
Copy Markdown
Owner

applied.

@bellard bellard closed this Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants