CR

ocsigen · Jan 25, 2025 · dcc5737 · dcc5737
1 parent 7adb8ec
commit dcc5737
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -21,6 +21,7 @@
 * Runtime: no longer leak channels
 * Runtime: Fix Marshal.to_buffer (#1798)
 * Runtime: unmarshalling objects should refresh its id
+* Runtime: check size upper bound during array creation
 
 # 5.9.1 (02-12-2024) - Lille
 

diff --git a/runtime/js/array.js b/runtime/js/array.js
@@ -158,7 +158,7 @@ function caml_check_bound(array, index) {
 //Provides: caml_array_make const (const, mutable)
 //Requires: caml_array_bound_error
 function caml_array_make(len, init) {
-  if (len < 0 || (len >= 0x7fffffff / 4) | 0) caml_array_bound_error();
+  if (len >>> 0 >= ((0x7fffffff / 4) | 0)) caml_array_bound_error();
   var len = (len + 1) | 0;
   var b = new Array(len);
   b[0] = 0;
@@ -175,7 +175,7 @@ function caml_make_vect(len, init) {
 //Provides: caml_make_float_vect const (const)
 //Requires: caml_array_bound_error
 function caml_make_float_vect(len) {
-  if (len < 0 || (len >= 0x7fffffff / 8) | 0) caml_array_bound_error();
+  if (len >>> 0 >= ((0x7fffffff / 8) | 0)) caml_array_bound_error();
   var len = (len + 1) | 0;
   var b = new Array(len);
   b[0] = 254;
@@ -187,7 +187,7 @@ function caml_make_float_vect(len) {
 //Requires: caml_array_bound_error
 //Version: >= 5.3
 function caml_array_create_float(len) {
-  if (len < 0 || (len >= 0x7fffffff / 8) | 0) caml_array_bound_error();
+  if (len >>> 0 >= ((0x7fffffff / 8) | 0)) caml_array_bound_error();
   var len = (len + 1) | 0;
   var b = new Array(len);
   b[0] = 254;
@@ -197,7 +197,7 @@ function caml_array_create_float(len) {
 //Provides: caml_floatarray_create const (const)
 //Requires: caml_array_bound_error
 function caml_floatarray_create(len) {
-  if (len < 0 || (len >= 0x7fffffff / 8) | 0) caml_array_bound_error();
+  if (len >>> 0 >= ((0x7fffffff / 8) | 0)) caml_array_bound_error();
   var len = (len + 1) | 0;
   var b = new Array(len);
   b[0] = 254;
@@ -209,7 +209,7 @@ function caml_floatarray_create(len) {
 //Requires: caml_array_bound_error
 //Version: >= 5.3
 function caml_floatarray_make(len, init) {
-  if (len < 0 || (len >= 0x7fffffff / 8) | 0) caml_array_bound_error();
+  if (len >>> 0 >= ((0x7fffffff / 8) | 0)) caml_array_bound_error();
   var len = (len + 1) | 0;
   var b = new Array(len);
   b[0] = 254;