Skip to content

Commit a4376e3

Browse files
Fix potential use-after-free in JSString
The guts' lifetime was not guaranteed to be longer than `swjs_value_equals` call, which could lead to a use-after-free.
1 parent 9b48693 commit a4376e3

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

Sources/JavaScriptKit/FundamentalObjects/JSString.swift

+5-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,11 @@ public struct JSString: LosslessStringConvertible, Equatable {
7777
/// - lhs: A string to compare.
7878
/// - rhs: Another string to compare.
7979
public static func == (lhs: JSString, rhs: JSString) -> Bool {
80-
return swjs_value_equals(lhs.guts.jsRef, rhs.guts.jsRef)
80+
withExtendedLifetime(lhs.guts) { lhsGuts in
81+
withExtendedLifetime(rhs.guts) { rhsGuts in
82+
return swjs_value_equals(lhsGuts.jsRef, rhsGuts.jsRef)
83+
}
84+
}
8185
}
8286
}
8387

0 commit comments

Comments
 (0)