[BUG] Integer overflow in Proxy ownKeys property enumeration causes heap buffer overflow (32-bit) #535

Summary

js_proxy_get_own_property_names() in quickjs.c contains an integer overflow in the allocation size computation for the property enumeration table. The expression sizeof(tab[0]) * len where sizeof(JSPropertyEnum) = 8 and len is an attacker-controlled uint32_t wraps to zero or a small value on 32-bit platforms when len >= 0x20000000 (536,870,912). The allocator returns a tiny buffer, and the subsequent loop writes len entries past it.

Root Cause

After the Proxy's ownKeys trap returns an array, the function computes:

tab = js_mallocz(ctx, sizeof(tab[0]) * len);

On 32-bit (sizeof(size_t) = 4): 8 * 0x20000000 = 0x100000000 wraps to 0. The js_mallocz(ctx, 0) path returns a singleton pointer. The initialization loop then writes len entries (up to 4 GB) past this allocation.

The Proxy trap only needs to return an array with length >= 0x20000000. The array entries themselves can be lazy getters (a few KB total), making this practical on memory-constrained 32-bit embedded devices -- QuickJS's primary deployment target.

Impact

Heap buffer overflow via crafted JavaScript on 32-bit platforms. QuickJS is widely deployed in embedded/IoT systems (ESP32, smart home, automotive) where 32-bit is the norm.

CWE-190 / CWE-122, CVSS 8.1