No issue - avoid potential underflow in StructuredClone.

Prevents potential loop-around if there's bogus internal Map data.
FranklinDM · Feb 16, 2025 · 4499f77 · 4499f77
1 parent 53b1740
commit 4499f77
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
@@ -1700,6 +1700,8 @@ JSStructuredCloneWriter::write(HandleValue v)
                 return false;
 
             if (cls == ESClass::Map) {
+                if (!counts.back())
+                    return false;
                 counts.back()--;
                 RootedValue val(context(), entries.back());
                 entries.popBack();