From fcf10649b5ab088466baf79fd26c8abdac8d699e Mon Sep 17 00:00:00 2001 From: Samir Date: Mon, 24 Aug 2026 19:11:33 -0400 Subject: [PATCH] Fix UAF from #1660 --- quickjs.c | 24 ++++++++++++++++-------- run-test262.c | 2 +- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/quickjs.c b/quickjs.c index 0e038ccff..9ad381707 100644 --- a/quickjs.c +++ b/quickjs.c @@ -56057,18 +56057,26 @@ static JSValue js_promise_withResolvers(JSContext *ctx, JSValueConst this_val, obj = JS_NewObject(ctx); if (JS_IsException(obj)) goto exception; - if (JS_DefinePropertyValue(ctx, obj, JS_ATOM_promise, result_promise, - JS_PROP_C_W_E) < 0) { - goto exception; - } + int res; + // Set property vals to undefined to avoid double free in case of exception + res = JS_DefinePropertyValue(ctx, obj, JS_ATOM_promise, result_promise, + JS_PROP_C_W_E); result_promise = JS_UNDEFINED; - if (JS_DefinePropertyValue(ctx, obj, JS_ATOM_resolve, resolving_funcs[0], - JS_PROP_C_W_E) < 0) { + if (res < 0) { goto exception; } + + res = JS_DefinePropertyValue(ctx, obj, JS_ATOM_resolve, resolving_funcs[0], + JS_PROP_C_W_E); resolving_funcs[0] = JS_UNDEFINED; - if (JS_DefinePropertyValue(ctx, obj, JS_ATOM_reject, resolving_funcs[1], - JS_PROP_C_W_E) < 0) { + if (res < 0) { + goto exception; + } + + res = JS_DefinePropertyValue(ctx, obj, JS_ATOM_reject, resolving_funcs[1], + JS_PROP_C_W_E); + resolving_funcs[1] = JS_UNDEFINED; + if (res < 0) { goto exception; } return obj; diff --git a/run-test262.c b/run-test262.c index 562c8a3d4..e0956bcf9 100644 --- a/run-test262.c +++ b/run-test262.c @@ -2389,4 +2389,4 @@ int main(int argc, char **argv) /* Signal that the error file is out of date. */ return new_errors || changed_errors || fixed_errors; -} +} \ No newline at end of file