eliott/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity synced 2026-05-09 08:32:04 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
2cff070108caf94061a33b4c8ccdfd8f0b8dbcf2
serenity/Userland/Libraries/LibJS/Runtime/GlobalObject.cpp
Andreas Kling 7df3b95126 LibJS: GlobalObject must mark builtin prototypes 
Failing to mark them leads to use-after-free since the GlobalObject
cached prototypes are used for new NumberObject, StringObject, etc.

Found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30319
2021-02-05 14:53:16 +01:00

11 KiB
Raw Blame History

View Raw
Reference in New Issue View Git Blame Copy Permalink