Skip to content

fix(run-test262): bounds-check optind before argv[optind] for -N#1481

Open
andreasrosdal wants to merge 1 commit into
quickjs-ng:masterfrom
nordstjernen-web:claude/sec-test262-optind-bounds
Open

fix(run-test262): bounds-check optind before argv[optind] for -N#1481
andreasrosdal wants to merge 1 commit into
quickjs-ng:masterfrom
nordstjernen-web:claude/sec-test262-optind-bounds

Conversation

@andreasrosdal
Copy link
Copy Markdown
Contributor

Running run-test262 -c <conf> -N without a trailing test file argument passed argv[optind] to run_test262_harness_testfopen() with argv[argc] being NULL on POSIX (uninitialised on some libcs), yielding a "Bad address" error or, on platforms that don't NULL-terminate argv, an out-of-bounds read.

Reject the missing argument explicitly with fatal().

Manual repro before the fix:

$ build/run-test262 -c tests.conf -N
run-test262: Bad address     # NULL fopen
exit code 1

After:

$ build/run-test262 -c tests.conf -N
run-test262: missing test file argument for -N
exit code 2

Running `run-test262 -c <conf> -N` without a trailing test file argument
passed `argv[optind]` to `run_test262_harness_test` → `fopen()` with
`argv[argc]` being NULL on POSIX (uninitialised on some libcs),
yielding a "Bad address" error or, on platforms that don't NULL-terminate
argv, an out-of-bounds read.

Reject the missing argument explicitly with `fatal()`.

Manual repro before the fix:

    $ build/run-test262 -c tests.conf -N
    run-test262: Bad address     # NULL fopen
    exit code 1

After:

    $ build/run-test262 -c tests.conf -N
    run-test262: missing test file argument for -N
    exit code 2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants