diff options
Diffstat (limited to 'js')
| -rw-r--r-- | js/src/wasm/WasmJS.cpp | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp index 07d6331b8..0b030c844 100644 --- a/js/src/wasm/WasmJS.cpp +++ b/js/src/wasm/WasmJS.cpp @@ -1484,6 +1484,20 @@ const JSPropertySpec WasmTableObject::properties[] = JS_PS_END }; +static bool +ToTableIndex(JSContext* cx, HandleValue v, const Table& table, const char* noun, uint32_t* index) +{ + if (!ToNonWrappingUint32(cx, v, UINT32_MAX, "Table", noun, index)) + return false; + + if (*index >= table.length()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_UINT32, "Table", noun); + return false; + } + + return true; +} + /* static */ bool WasmTableObject::getImpl(JSContext* cx, const CallArgs& args) { @@ -1491,7 +1505,7 @@ WasmTableObject::getImpl(JSContext* cx, const CallArgs& args) const Table& table = tableObj->table(); uint32_t index; - if (!ToNonWrappingUint32(cx, args.get(0), table.length() - 1, "Table", "get index", &index)) + if (!ToTableIndex(cx, args.get(0), table, "get index", &index)) return false; ExternalTableElem& elem = table.externalArray()[index]; @@ -1530,7 +1544,7 @@ WasmTableObject::setImpl(JSContext* cx, const CallArgs& args) return false; uint32_t index; - if (!ToNonWrappingUint32(cx, args.get(0), table.length() - 1, "Table", "set index", &index)) + if (!ToTableIndex(cx, args.get(0), table, "set index", &index)) return false; RootedFunction value(cx); |