Firefox · SpiderMonkey
CVE-2026-4716
Uninitialized Memory in SpiderMonkey
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/vm/ArrayBufferObject.cpp |
modified |
Files Changed
js/src/vm/ArrayBufferObject.cpp
Patch
diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp
index 160e87eba37..3695d1b18fb 100644
--- a/js/src/vm/ArrayBufferObject.cpp
+++ b/js/src/vm/ArrayBufferObject.cpp
@@ -2630,36 +2630,15 @@ template <class ArrayBufferType>
size_t sourceByteLength = source->byteLength();
size_t newMaxByteLength = source->maxByteLength();
- if (newByteLength > sourceByteLength) {
- // Copy into a larger buffer.
- AutoSetNewObjectMetadata metadata(cx);
- auto [buffer, toFill] = createBufferAndData<FillContents::Zero>(
- cx, newByteLength, newMaxByteLength, metadata, nullptr);
- if (!buffer) {
- return nullptr;
- }
-
- // The `createBufferAndData()` call first zero-initializes the complete
- // buffer and then we copy over |sourceByteLength| bytes from |source|. It
- // seems prudent to only zero-initialize the trailing bytes of |toFill|
- // to avoid writing twice to `toFill[0..newByteLength]`. We don't yet
- // implement this optimization, because this method is only called for
- // small, inline buffers, so any write optimizations probably won't make
- // much of a difference.
- std::copy_n(source->dataPointer(), sourceByteLength, toFill);
-
- return buffer;
- }
-
- // Copy into a smaller or same size buffer.
AutoSetNewObjectMetadata metadata(cx);
- auto [buffer, toFill] = createBufferAndData<FillContents::Uninitialized>(
+ auto [buffer, toFill] = createBufferAndData<FillContents::Zero>(
cx, newByteLength, newMaxByteLength, metadata, nullptr);
if (!buffer) {
return nullptr;
}
- std::uninitialized_copy_n(source->dataPointer(), newByteLength, toFill);
+ size_t nbytes = std::min(newByteLength, sourceByteLength);
+ std::copy_n(source->dataPointer(), nbytes, toFill);
return buffer;
}
Loading diff…
References
On This Page