Skip to content
Snippets Groups Projects
Commit 049c18c4 authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

Fix potential null object pointer passed to JS_GetProperty in js_gotoxy()

I'm not sure under what script conditions this could happen, but apparently
Nelgin was able to produce this null pointer deref (and segfault) using
DDMsgReader. This should fix issue #769
parent 60e75edb
No related branches found
No related tags found
1 merge request!455Update branch with changes from master
Pipeline #6526 passed
...@@ -1930,10 +1930,13 @@ js_gotoxy(JSContext *cx, uintN argc, jsval *arglist) ...@@ -1930,10 +1930,13 @@ js_gotoxy(JSContext *cx, uintN argc, jsval *arglist)
JS_SET_RVAL(cx, arglist, JSVAL_VOID); JS_SET_RVAL(cx, arglist, JSVAL_VOID);
if(JSVAL_IS_OBJECT(argv[0])) { if(JSVAL_IS_OBJECT(argv[0])) {
if(!JS_GetProperty(cx, JSVAL_TO_OBJECT(argv[0]),"x", &val) JSObject* obj = JSVAL_TO_OBJECT(argv[0]);
if(obj == nullptr)
return JS_FALSE;
if(!JS_GetProperty(cx, obj, "x", &val)
|| !JS_ValueToInt32(cx,val,&x)) || !JS_ValueToInt32(cx,val,&x))
return JS_FALSE; return JS_FALSE;
if(!JS_GetProperty(cx, JSVAL_TO_OBJECT(argv[0]),"y", &val) if(!JS_GetProperty(cx, obj, "y", &val)
|| !JS_ValueToInt32(cx,val,&y)) || !JS_ValueToInt32(cx,val,&y))
return JS_FALSE; return JS_FALSE;
} else { } else {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment