[njs] Fixed Function.prototype.apply() with slow arrays.

[Dmitry Volyntsev]

details:   https://hg.nginx.org/njs/rev/620418b1a641
branches:  
changeset: 1813:620418b1a641
user:      Dmitry Volyntsev <xeioex at nginx.com>
date:      Wed Jan 19 14:03:49 2022 +0000
description:
Fixed Function.prototype.apply() with slow arrays.

Previously, the function had two issues:
   * array->start was referenced without checking for fast array flag
   * the created arguments list was not sanity-checked for its length,
     which can be very large.

The fix is to remove micro-optimization for arrays and introduce limit
size for arguments list.

This closes #449 issue in Github.

diffstat:

 src/njs_function.c       |  17 +++++++----------
 src/test/njs_unit_test.c |   4 ++++
 2 files changed, 11 insertions(+), 10 deletions(-)

diffs (50 lines):

diff -r c419a4e34998 -r 620418b1a641 src/njs_function.c
--- a/src/njs_function.c	Wed Jan 19 13:12:09 2022 +0000
+++ b/src/njs_function.c	Wed Jan 19 14:03:49 2022 +0000
@@ -1385,18 +1385,10 @@ njs_function_prototype_apply(njs_vm_t *v
 
     if (njs_is_null_or_undefined(arr_like)) {
         length = 0;
-
         goto activate;
-
-    } else if (njs_is_array(arr_like)) {
-        arr = arr_like->data.u.array;
+    }
 
-        args = arr->start;
-        length = arr->length;
-
-        goto activate;
-
-    } else if (njs_slow_path(!njs_is_object(arr_like))) {
+    if (njs_slow_path(!njs_is_object(arr_like))) {
         njs_type_error(vm, "second argument is not an array-like object");
         return NJS_ERROR;
     }
@@ -1406,6 +1398,11 @@ njs_function_prototype_apply(njs_vm_t *v
         return ret;
     }
 
+    if (njs_slow_path(length > 1024)) {
+        njs_internal_error(vm, "argument list is too long");
+        return NJS_ERROR;
+    }
+
     arr = njs_array_alloc(vm, 1, length, NJS_ARRAY_SPARE);
     if (njs_slow_path(arr == NULL)) {
         return NJS_ERROR;
diff -r c419a4e34998 -r 620418b1a641 src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c	Wed Jan 19 13:12:09 2022 +0000
+++ b/src/test/njs_unit_test.c	Wed Jan 19 14:03:49 2022 +0000
@@ -10063,6 +10063,10 @@ static njs_unit_test_t  njs_test[] =
                  "f.apply(123, {})"),
       njs_str("123") },
 
+    { njs_str("(function(index, ...rest){ return rest[index];})"
+              ".apply({}, [1022].concat(Array(1023).fill(1).map((v,i)=>i.toString(16))))"),
+      njs_str("3fe") },
+
     { njs_str("String.prototype.concat.apply('a', "
                  "{length:2, 0:{toString:function() {return 'b'}}, 1:'c'})"),
       njs_str("abc") },