Bug 1520783 - Check whether the path passed to createMappedArrayBuffer() is a regular file. r=sfink, a=RyanVM
authorJon Coppeard <jcoppeard@mozilla.com>
Fri, 01 Feb 2019 02:07:00 +0200
changeset 512926 3b7ebdaada3d017ef158294cc3236877c2aa980b
parent 512925 d1a2c942512741c9a79b143e574040f9176fffc5
child 512927 f8aadf41dcd052cf78272d82fd262094a8e26567
push id10644
push userryanvm@gmail.com
push dateThu, 07 Feb 2019 15:29:46 +0000
treeherdermozilla-beta@8232af0a1a56 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink, RyanVM
bugs1520783
milestone66.0
Bug 1520783 - Check whether the path passed to createMappedArrayBuffer() is a regular file. r=sfink, a=RyanVM
js/src/jit-test/tests/basic/bug1520783.js
js/src/shell/js.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1520783.js
@@ -0,0 +1,2 @@
+// |jit-test| error: Error
+createMappedArrayBuffer("");
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1529,22 +1529,28 @@ static bool CreateMappedArrayBuffer(JSCo
 
   FILE* file = fopen(filename.get(), "rb");
   if (!file) {
     ReportCantOpenErrorUnknownEncoding(cx, filename.get());
     return false;
   }
   AutoCloseFile autoClose(file);
 
+  struct stat st;
+  if (fstat(fileno(file), &st) < 0) {
+    JS_ReportErrorASCII(cx, "Unable to stat file");
+    return false;
+  }
+
+  if ((st.st_mode & S_IFMT) != S_IFREG) {
+    JS_ReportErrorASCII(cx, "Path is not a regular file");
+    return false;
+  }
+
   if (!sizeGiven) {
-    struct stat st;
-    if (fstat(fileno(file), &st) < 0) {
-      JS_ReportErrorASCII(cx, "Unable to stat file");
-      return false;
-    }
     if (off_t(offset) >= st.st_size) {
       JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                                 JSMSG_OFFSET_LARGER_THAN_FILESIZE);
       return false;
     }
     size = st.st_size - offset;
   }