@mikrojs/quickjs 0.18.0 → 0.18.1

package/deps/quickjs/quickjs.c

@@ -30364,27 +30364,36 @@ static void js_free_module_def(JSContext *ctx, JSModuleDef *m)
 
     JS_FreeAtom(ctx, m->module_name);
 
-    for(i = 0; i < m->req_module_entries_count; i++) {
-        JSReqModuleEntry *rme = &m->req_module_entries[i];
-        JS_FreeAtom(ctx, rme->module_name);
-        JS_FreeValue(ctx, rme->attributes);
+    /* mikrojs patch: a partially-deserialized module (JS_ReadModule OOM
+       mid-read) can carry a non-zero entry count with a NULL array — the
+       count is decoded before the array allocation. Guard each loop. */
+    if (m->req_module_entries) {
+        for(i = 0; i < m->req_module_entries_count; i++) {
+            JSReqModuleEntry *rme = &m->req_module_entries[i];
+            JS_FreeAtom(ctx, rme->module_name);
+            JS_FreeValue(ctx, rme->attributes);
+        }
     }
     js_free(ctx, m->req_module_entries);
 
-    for(i = 0; i < m->export_entries_count; i++) {
-        JSExportEntry *me = &m->export_entries[i];
-        if (me->export_type == JS_EXPORT_TYPE_LOCAL)
-            free_var_ref(ctx->rt, me->u.local.var_ref);
-        JS_FreeAtom(ctx, me->export_name);
-        JS_FreeAtom(ctx, me->local_name);
+    if (m->export_entries) {
+        for(i = 0; i < m->export_entries_count; i++) {
+            JSExportEntry *me = &m->export_entries[i];
+            if (me->export_type == JS_EXPORT_TYPE_LOCAL)
+                free_var_ref(ctx->rt, me->u.local.var_ref);
+            JS_FreeAtom(ctx, me->export_name);
+            JS_FreeAtom(ctx, me->local_name);
+        }
     }
     js_free(ctx, m->export_entries);
 
     js_free(ctx, m->star_export_entries);
 
-    for(i = 0; i < m->import_entries_count; i++) {
-        JSImportEntry *mi = &m->import_entries[i];
-        JS_FreeAtom(ctx, mi->import_name);
+    if (m->import_entries) {
+        for(i = 0; i < m->import_entries_count; i++) {
+            JSImportEntry *mi = &m->import_entries[i];
+            JS_FreeAtom(ctx, mi->import_name);
+        }
     }
     js_free(ctx, m->import_entries);
     js_free(ctx, m->async_parent_modules);
@@ -34181,6 +34190,14 @@ static int resolve_scope_var(JSContext *ctx, JSFunctionDef *s,
             idx = get_closure_var(ctx, s, fd, JS_CLOSURE_LOCAL,
                                   fd->var_object_idx, vd->var_name,
                                   false, false, JS_VAR_NORMAL);
+            /* mikrojs patch: get_closure_var fails under OOM; the -1 index
+               would be emitted as var_ref 65535 (or dereference
+               closure_var[-1] at has_idx). Poison the dbuf so
+               resolve_variables reports the error. */
+            if (idx < 0) {
+                dbuf_set_error(bc);
+                goto done;
+            }
             dbuf_putc(bc, OP_get_var_ref);
             dbuf_put_u16(bc, idx);
             var_object_test(ctx, s, var_name, op, bc, &label_done, 0);
@@ -34193,6 +34210,11 @@ static int resolve_scope_var(JSContext *ctx, JSFunctionDef *s,
             idx = get_closure_var(ctx, s, fd, JS_CLOSURE_LOCAL,
                                   fd->arg_var_object_idx, vd->var_name,
                                   false, false, JS_VAR_NORMAL);
+            /* mikrojs patch: see the eval object case above */
+            if (idx < 0) {
+                dbuf_set_error(bc);
+                goto done;
+            }
             dbuf_putc(bc, OP_get_var_ref);
             dbuf_put_u16(bc, idx);
             var_object_test(ctx, s, var_name, op, bc, &label_done, 0);
@@ -34220,6 +34242,11 @@ static int resolve_scope_var(JSContext *ctx, JSFunctionDef *s,
                 } else {
                     idx = idx1;
                 }
+                /* mikrojs patch: see the eval object case above */
+                if (idx < 0) {
+                    dbuf_set_error(bc);
+                    goto done;
+                }
                 goto has_idx;
             } else if ((cv->var_name == JS_ATOM__var_ ||
                         cv->var_name == JS_ATOM__arg_var_ ||
@@ -34234,6 +34261,11 @@ static int resolve_scope_var(JSContext *ctx, JSFunctionDef *s,
                 } else {
                     idx = idx1;
                 }
+                /* mikrojs patch: see the eval object case above */
+                if (idx < 0) {
+                    dbuf_set_error(bc);
+                    goto done;
+                }
                 dbuf_putc(bc, OP_get_var_ref);
                 dbuf_put_u16(bc, idx);
                 var_object_test(ctx, s, var_name, op, bc, &label_done, is_with);
@@ -35939,18 +35971,24 @@ static __exception int resolve_labels(JSContext *ctx, JSFunctionDef *s)
                 for(re = ls->first_reloc; re != NULL; re = re_next) {
                     int diff = ls->addr - re->addr;
                     re_next = re->next;
-                    switch (re->size) {
-                    case 4:
-                        put_u32(bc_out.buf + re->addr, diff);
-                        break;
-                    case 2:
-                        assert(diff == (int16_t)diff);
-                        put_u16(bc_out.buf + re->addr, diff);
-                        break;
-                    case 1:
-                        assert(diff == (int8_t)diff);
-                        put_u8(bc_out.buf + re->addr, diff);
-                        break;
+                    /* mikrojs patch: after a dbuf OOM the recorded addresses
+                       no longer match the buffer contents (and the buffer may
+                       be NULL); skip the writes and let the dbuf_error check
+                       at the end of resolve_labels report the failure. */
+                    if (!dbuf_error(&bc_out)) {
+                        switch (re->size) {
+                        case 4:
+                            put_u32(bc_out.buf + re->addr, diff);
+                            break;
+                        case 2:
+                            assert(diff == (int16_t)diff);
+                            put_u16(bc_out.buf + re->addr, diff);
+                            break;
+                        case 1:
+                            assert(diff == (int8_t)diff);
+                            put_u8(bc_out.buf + re->addr, diff);
+                            break;
+                        }
                     }
                     js_free(ctx, re);
                 }
@@ -36635,6 +36673,11 @@ static __exception int resolve_labels(JSContext *ctx, JSFunctionDef *s)
 
     /* more jump optimizations */
     patch_offsets = 0;
+    /* mikrojs patch: on dbuf OOM the recorded jump/label offsets are stale
+       relative to the buffer contents; skip the peephole passes and let the
+       dbuf_error check below report the failure. */
+    if (dbuf_error(&bc_out))
+        goto skip_peephole;
     for (i = 0, jp = s->jump_slots; i < s->jump_count; i++, jp++) {
         LabelSlot *ls;
         JumpSlot *jp1;
@@ -36708,6 +36751,7 @@ static __exception int resolve_labels(JSContext *ctx, JSFunctionDef *s)
         }
     }
 
+ skip_peephole: /* mikrojs patch */
     js_free(ctx, s->jump_slots);
     s->jump_slots = NULL;
     js_free(ctx, s->label_slots);
@@ -37096,6 +37140,14 @@ static JSValue js_create_function(JSContext *ctx, JSFunctionDef *fd)
     }
 #endif
 
+    /* mikrojs patch: a dbuf error during emission leaves byte_code truncated
+       relative to its opcode structure; the resolve passes would then read
+       past the end of the buffer. Fail before walking it. */
+    if (dbuf_error(&fd->byte_code)) {
+        JS_ThrowOutOfMemory(ctx);
+        goto fail;
+    }
+
     if (resolve_variables(ctx, fd))
         goto fail;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikrojs/quickjs",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "QuickJS-NG engine source, shared CMake module, and qjsc bytecode compiler",
   "keywords": [
     "bytecode",