[njs] Fixed %TypedArray%.prototype.slice() with overlapping buffers.

[noreply at nginx.com]

details:   https://github.com/nginx/njs/commit/efb0454a59f49dc8874d772c8c245460f49e6671
branches:  master
commit:    efb0454a59f49dc8874d772c8c245460f49e6671
user:      Dmitry Volyntsev <xeioex at nginx.com>
date:      Thu, 12 Jun 2025 15:34:39 -0700
description:
Fixed %TypedArray%.prototype.slice() with overlapping buffers.


---
 src/njs_typed_array.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/njs_typed_array.c b/src/njs_typed_array.c
index 83e3b9f1..f886dca6 100644
--- a/src/njs_typed_array.c
+++ b/src/njs_typed_array.c
@@ -912,6 +912,20 @@ njs_typed_array_prototype_fill(njs_vm_t *vm, njs_value_t *args,
 }
 
 
+static void
+njs_slice_memcpy(uint8_t *dst, const uint8_t *src, size_t len)
+{
+    if (dst + len <= src || dst >= src + len) {
+        /* no overlap: can use memcpy */
+        memcpy(dst, src, len);
+
+    } else {
+        while (len-- != 0)
+            *dst++ = *src++;
+    }
+}
+
+
 njs_int_t
 njs_typed_array_prototype_slice(njs_vm_t *vm, njs_value_t *args,
     njs_uint_t nargs, njs_index_t copy, njs_value_t *retval)
@@ -990,7 +1004,7 @@ njs_typed_array_prototype_slice(njs_vm_t *vm, njs_value_t *args,
             start = start * element_size;
             count = count * element_size;
 
-            memcpy(&new_buffer->u.u8[0], &buffer->u.u8[start], count);
+            njs_slice_memcpy(&new_buffer->u.u8[0], &buffer->u.u8[start], count);
 
         } else {
             for (i = 0; i < count; i++) {