XS: #896

Moddable-OpenSource · Apr 12, 2022 · 135aa9a · 135aa9a
1 parent 249ec43
commit 135aa9a
Showing 1 changed file with 9 additions and 5 deletions.
diff --git a/xs/sources/xsDataView.c b/xs/sources/xsDataView.c
@@ -773,7 +773,8 @@ void fx_DataView(txMachine* the)
 		mxRangeError("out of range byteOffset %ld", offset);
 	size = fxArgToByteLength(the, 2, -1);
 	if (size >= 0) {
-		if (info->value.bufferInfo.length < (offset + size))
+		txInteger end = offset + size;
+		if ((info->value.bufferInfo.length < end) || (end < offset))
 			mxRangeError("out of range byteLength %ld", size);
 	}
 	else {
@@ -793,7 +794,8 @@ void fx_DataView(txMachine* the)
 		if (info->value.bufferInfo.length < offset)
 			mxRangeError("out of range byteOffset %ld", offset);
 		else if (size >= 0) {
-			if (info->value.bufferInfo.length < (offset + size))
+			txInteger end = offset + size;
+			if ((info->value.bufferInfo.length < end) || (end < offset))
 				mxRangeError("out of range byteLength %ld", size);
 		}
 	}
@@ -1360,9 +1362,11 @@ void fx_TypedArray(txMachine* the)
 			size = fxArgToByteLength(the, 2, -1);
 			info = fxGetBufferInfo(the, mxArgv(0));
 			if (size >= 0) {
-				size <<= shift;
-				if (info->value.bufferInfo.length < (offset + size))
-					mxRangeError("out of range byteLength %ld", size);
+				txInteger delta = size << shift;
+				txInteger end = offset + delta;
+				if ((info->value.bufferInfo.length < end) || (end < offset))
+					mxRangeError("out of range length %ld", size);
+				size = delta;
 			}
 			else {
 				if (info->value.bufferInfo.length & ((1 << shift) - 1))