Fix possible pointer out-of-bounds issue

hvwyl · web-flow · commit d5dd7e8e34aa · 2025-07-12T01:13:38.000+08:00
diff --git a/jerry-core/vm/vm.c b/jerry-core/vm/vm.c
@@ -2955,8 +2955,9 @@ vm_loop (vm_frame_ctx_t *frame_ctx_p) /**< frame context */
         case VM_OC_PROP_PRE_DECR:
         case VM_OC_PROP_POST_INCR:
         case VM_OC_PROP_POST_DECR:
-        if (byte_code_start_p[-3] == CBC_EXT_OPCODE
-            && byte_code_start_p[-2] == CBC_EXT_PUSH_PRIVATE_PROP_LITERAL_REFERENCE)
+        if (JERRY_UNLIKELY (byte_code_start_p - 3 >= frame_ctx_p->byte_code_p
+                            && byte_code_start_p[-3] == CBC_EXT_OPCODE
+                            && byte_code_start_p[-2] == CBC_EXT_PUSH_PRIVATE_PROP_LITERAL_REFERENCE))
         {
           if (opcode < CBC_PRE_INCR)
           {

Original file line number	Diff line number	Diff line change
`@@ -2955,8 +2955,9 @@ vm_loop (vm_frame_ctx_t frame_ctx_p) /< frame context /`
`2955`	`2955`	`case VM_OC_PROP_PRE_DECR:`
`2956`	`2956`	`case VM_OC_PROP_POST_INCR:`
`2957`	`2957`	`case VM_OC_PROP_POST_DECR:`
`2958`		`- if (byte_code_start_p[-3] == CBC_EXT_OPCODE`
`2959`		`- && byte_code_start_p[-2] == CBC_EXT_PUSH_PRIVATE_PROP_LITERAL_REFERENCE)`
	`2958`	`+ if (JERRY_UNLIKELY (byte_code_start_p - 3 >= frame_ctx_p->byte_code_p`
	`2959`	`+ && byte_code_start_p[-3] == CBC_EXT_OPCODE`
	`2960`	`+ && byte_code_start_p[-2] == CBC_EXT_PUSH_PRIVATE_PROP_LITERAL_REFERENCE))`
`2960`	`2961`	`{`
`2961`	`2962`	`if (opcode < CBC_PRE_INCR)`
`2962`	`2963`	`{`