Skip to content
Snippets Groups Projects
Select Git revision
  • dailybuild_linux-x64
  • master default protected
  • dailybuild_win32
  • sqlite
  • rip_abstraction
  • dailybuild_macos-armv8
  • dd_file_lister_filanem_in_desc_color
  • mode7
  • dd_msg_reader_are_you_there_warning_improvement
  • c23-playing
  • syncterm-1.3
  • syncterm-1.2
  • test-build
  • hide_remote_connection_with_telgate
  • 638-can-t-control-c-during-a-file-search
  • add_body_to_pager_email
  • mingw32-build
  • cryptlib-3.4.7
  • ree/mastermind
  • new_user_dat
  • sbbs320d
  • syncterm-1.6
  • syncterm-1.5
  • syncterm-1.4
  • sbbs320b
  • syncterm-1.3
  • syncterm-1.2
  • syncterm-1.2rc6
  • syncterm-1.2rc5
  • push
  • syncterm-1.2rc4
  • syncterm-1.2rc2
  • syncterm-1.2rc1
  • sbbs319b
  • sbbs318b
  • goodbuild_linux-x64_Sep-01-2020
  • goodbuild_win32_Sep-01-2020
  • goodbuild_linux-x64_Aug-31-2020
  • goodbuild_win32_Aug-31-2020
  • goodbuild_win32_Aug-30-2020
40 results

js_conio.c

Blame
    • Rob Swindell's avatar
      54523145
      Prevent NULL pointer dereference when 'null' object passed to JS functions · 54523145
      Rob Swindell authored
      As was discovered as part of investigation into issue #769, a JavaScript
      could crash SBBS (cause a segfault) due to a NULL pointer dereference when
      the script passes 'null' to native JS functions where an object is expected.
      
      The issue raised was with console.gotoxy(), but it turns out that *many*
      Synchronet native JS functions would call JSVAL_TO_OBJECT() and then, without
      checking for NULL/nullptr, pass its return value to JS api functions such as
      JS_GetPrivate, JS_GetProperty, JS_GetClass, JS_ObjectIsFunction,
      JS_IsArrayObject, JS_GetArrayLength, JS_DefineProperty, JS_Enumerate, etc.
      All of these JS API functions dereference the passed object pointer without
      NULL/nullptr checking.
      
      The fix here is to either call JSVAL_IS_NULL() or JSVAL_NULL_OR_VOID() and
      if true, not call JSVAL_TO_OBJECT() and/or check the return value for the NULL
      value before using as an argument to any other JS API functions.
      54523145
      History
      Prevent NULL pointer dereference when 'null' object passed to JS functions
      Rob Swindell authored
      As was discovered as part of investigation into issue #769, a JavaScript
      could crash SBBS (cause a segfault) due to a NULL pointer dereference when
      the script passes 'null' to native JS functions where an object is expected.
      
      The issue raised was with console.gotoxy(), but it turns out that *many*
      Synchronet native JS functions would call JSVAL_TO_OBJECT() and then, without
      checking for NULL/nullptr, pass its return value to JS api functions such as
      JS_GetPrivate, JS_GetProperty, JS_GetClass, JS_ObjectIsFunction,
      JS_IsArrayObject, JS_GetArrayLength, JS_DefineProperty, JS_Enumerate, etc.
      All of these JS API functions dereference the passed object pointer without
      NULL/nullptr checking.
      
      The fix here is to either call JSVAL_IS_NULL() or JSVAL_NULL_OR_VOID() and
      if true, not call JSVAL_TO_OBJECT() and/or check the return value for the NULL
      value before using as an argument to any other JS API functions.