Summary
js_proxy_get_own_property_names() in quickjs.c contains an integer overflow in the allocation size computation for the property enumeration table. The expression sizeof(tab[0]) * len where sizeof(JSPropertyEnum) = 8 and len is an attacker-controlled uint32_t wraps to zero or a small value on 32-bit platforms when len >= 0x20000000 (536,870,912). The allocator returns a tiny buffer, and the subsequent loop writes len entries past it.
Root Cause
After the Proxy's ownKeys trap returns an array, the function computes:
tab = js_mallocz(ctx, sizeof(tab[0]) * len);
On 32-bit (sizeof(size_t) = 4): 8 * 0x20000000 = 0x100000000 wraps to 0. The js_mallocz(ctx, 0) path returns a singleton pointer. The initialization loop then writes len entries (up to 4 GB) past this allocation.
The Proxy trap only needs to return an array with length >= 0x20000000. The array entries themselves can be lazy getters (a few KB total), making this practical on memory-constrained 32-bit embedded devices -- QuickJS's primary deployment target.
Impact
Heap buffer overflow via crafted JavaScript on 32-bit platforms. QuickJS is widely deployed in embedded/IoT systems (ESP32, smart home, automotive) where 32-bit is the norm.
CWE-190 / CWE-122, CVSS 8.1
Summary
js_proxy_get_own_property_names()inquickjs.ccontains an integer overflow in the allocation size computation for the property enumeration table. The expressionsizeof(tab[0]) * lenwheresizeof(JSPropertyEnum) = 8andlenis an attacker-controlleduint32_twraps to zero or a small value on 32-bit platforms whenlen >= 0x20000000(536,870,912). The allocator returns a tiny buffer, and the subsequent loop writeslenentries past it.Root Cause
After the Proxy's
ownKeystrap returns an array, the function computes:On 32-bit (
sizeof(size_t) = 4):8 * 0x20000000 = 0x100000000wraps to0. Thejs_mallocz(ctx, 0)path returns a singleton pointer. The initialization loop then writeslenentries (up to 4 GB) past this allocation.The Proxy trap only needs to return an array with
length >= 0x20000000. The array entries themselves can be lazy getters (a few KB total), making this practical on memory-constrained 32-bit embedded devices -- QuickJS's primary deployment target.Impact
Heap buffer overflow via crafted JavaScript on 32-bit platforms. QuickJS is widely deployed in embedded/IoT systems (ESP32, smart home, automotive) where 32-bit is the norm.
CWE-190 / CWE-122, CVSS 8.1