From f0fb6575b1e117a0826f8913d3bd7bc55408b6a4 Mon Sep 17 00:00:00 2001 From: Tony Coder <407243179@qq.com> Date: Mon, 31 Aug 2026 09:54:57 +0800 Subject: [PATCH] fix: reject invalid IC stack positions Signed-off-by: Tony Coder <407243179@qq.com> --- ecmascript/ic/ic_runtime.cpp | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/ecmascript/ic/ic_runtime.cpp b/ecmascript/ic/ic_runtime.cpp index b537f58ae2..2619a5a178 100644 --- a/ecmascript/ic/ic_runtime.cpp +++ b/ecmascript/ic/ic_runtime.cpp @@ -14,6 +14,9 @@ */ #include "ecmascript/ic/ic_runtime.h" + +#include + #include "ecmascript/ic/ic_handler.h" #include "ecmascript/interpreter/interpreter.h" #include "ecmascript/interpreter/slow_runtime_stub.h" @@ -574,9 +577,16 @@ void ICRuntime::TraceIC([[maybe_unused]] JSThread *thread, JsFrameInfo jsFrameInfo = jsStackInfo.front(); size_t pos = jsFrameInfo.pos.find(':', 0); if (pos != CString::npos) { - int lineNumber = std::stoi(jsFrameInfo.pos.substr(0, pos)); - int columnNumber = std::stoi(jsFrameInfo.pos.substr(pos + 1)); - if (!jsFrameInfo.fileName.empty()) { + auto parsePosition = [](const std::string &value, int &result) { + const char *begin = value.data(); + const char *end = begin + value.size(); + auto parsed = std::from_chars(begin, end, result); + return parsed.ec == std::errc{} && parsed.ptr == end; + }; + int lineNumber = 0; + int columnNumber = 0; + if (parsePosition(jsFrameInfo.pos.substr(0, pos), lineNumber) && + parsePosition(jsFrameInfo.pos.substr(pos + 1), columnNumber) && !jsFrameInfo.fileName.empty()) { SourceMap::GetInstance().TranslateUrlPositionBySourceMap( jsFrameInfo.fileName, lineNumber, columnNumber, jsFrameInfo.packageName); }