jerryscript · Issues· 246 open

[Bug]Snapshot deserialization lacks bounds checks on untrusted offset/length fields -> out-of-bounds read (SEGV / ASan use-after-poison / DoS) (CWE-125)

[Bug]Malformed snapshot bytecode drives VM-init stack-buffer-overflow (vm_init_exec, vm.c:5190) (CWE-125)

[Bug]ecma_make_number_value casts out-of-range double to integer -> UBSan float-cast-overflow (SIGILL) (CWE-681)

[Bug]lexer_construct_number_object casts oversized numeric literal to int32 -> UBSan float-cast-overflow (SIGILL) (CWE-681)

Unusual Multithreading API

Ungraceful handling of stack overflow

JerryScript: Proxy getOwnPropertyDescriptor invariant check misses descriptor defaults

JerryScript: Proxy deleteProperty invariant checks can raise two exceptions and abort debug builds

JerryScript: malformed snapshot literal offset causes out-of-bounds read in ecma_snapshot_get_literal

JerryScript: configurable module namespace re-export causes type confusion and crash

jerryscript jerry-snapshot tool: unbounded literals-list parser → global-buffer-overflow (OOB write) in process_generate

jerryscript: NULL-pointer dereference in ES-module linker (ecma_module_resolve_import) via duplicate var/namespace-import binding — pre-link crash

Private security contact for multiple snapshot loader memory corruption issues

Segmentation fault on self-referential array raised to power of zero

Simple non fixed size jerry_string_to_buffer alternative?