quickjs · Issues· 88 open

Update to Unicode 18.0.0

BigInt.asUintN returns signed values for 64-bit width

JS_PrintValue can read detached TypedArray storage after a reentrant write callback

add jsfuck compatibility(suggestions)

[BUG] qjs: SIGSEGV in find_own_property during backtrace construction

[Bug]dynamic-stack-buffer-overflow read in JS_CallInternal: undersized call frame for the executed bytecode (CWE-125)

[Bug]Heap-buffer-overflow read in JS_CallInternal: executing a function with empty (byte_code_len == 0) bytecode reads the first opcode past the buffer (CWE-125)

[Bug]Heap-buffer-overflow WRITE in JS_ReadFunctionTag: negative count wraps the allocation size below the header size (CWE-787)

[[Bug]Heap-buffer-overflow read in JS_DupAtom: ROM_DATA bytecode uses an unvalidated atom index (rt->atom_array OOB) (CWE-125)

[Bug]Heap-buffer-overflow read in JS_ReadFunctionBytecode atom-fixup loop (get_u32 past the bytecode buffer) (CWE-125)

Security findings: BigInt interrupt-bypass CPU DoS (verified) and 5 other issues — commit 04be246

Support for RegExp buffer boundaries

`TypeError` with code like `[1,2,3].values().map(n=>n).take(2).toArray()`

`os.Worker` Can Call a NULL Context-Factory Callback in an Incompletely Initialized Embedder

[BUG] Integer overflow in Proxy ownKeys property enumeration causes heap buffer overflow (32-bit)