Skip to content

Fix UAF in fast array delete#1438

Merged
saghul merged 1 commit intoquickjs-ng:masterfrom
leegn4a:issue-1430-fast-array-delete
Apr 8, 2026
Merged

Fix UAF in fast array delete#1438
saghul merged 1 commit intoquickjs-ng:masterfrom
leegn4a:issue-1430-fast-array-delete

Conversation

@leegn4a
Copy link
Copy Markdown
Contributor

@leegn4a leegn4a commented Apr 3, 2026

This is an extension of #1430.

Patch

delete arr[last] must preserve arr.length, so the fix should not try to shrink the public length. This change removes the special-case last-element fast path in delete_property() and falls back to the existing convert_fast_array_to_array(ctx, p) path before goto redo;.

Testing

  • build/qjs tests/bug1430.js
  • make test

@saghul saghul merged commit 1b0b660 into quickjs-ng:master Apr 8, 2026
122 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants