Permalink
Browse files

XS: fix Array fill and sort overflows

  • Loading branch information...
Patrick Soquet authored and mkellner committed Sep 27, 2018
1 parent 56ef10e commit 0aaa6601e66ee8558e02b4958daa0cf1136b83f4
Showing with 6 additions and 2 deletions.
  1. +2 −2 xs/sources/xsArray.c
  2. +4 −0 xs/sources/xsProperty.c
@@ -1969,8 +1969,8 @@ void fx_Array_prototype_sort(txMachine* the)
i = lo + 1;
j = hi - 1;
do {
while (COMPARE(i) < 0) i++;
while (COMPARE(j) > 0) j--;
while ((COMPARE(i) < 0) && (i <= j)) i++;
while ((COMPARE(j) > 0) && (i <= j)) j--;
if (i < j) {
PUSH(i);
MOVE(j, i);
@@ -404,6 +404,10 @@ void fxSetIndexSize(txMachine* the, txSlot* array, txIndex target)
txSlot* address = array->value.array.address;
txSlot* chunk = C_NULL;
txIndex size = (address) ? (((txChunk*)(((txByte*)address) - sizeof(txChunk)))->size) / sizeof(txSlot) : 0;
if (target > (0x7FFFFFFF / sizeof(txSlot))) {
fxReport(the, "# too big array\n");
fxJump(the);
}
if (size != target) {
if (array->flag & XS_DONT_SET_FLAG)
mxTypeError("set length: not writable");

0 comments on commit 0aaa660

Please sign in to comment.