validate child index in YGNodeSwapChild and YGNodeInsertChild#1971
validate child index in YGNodeSwapChild and YGNodeInsertChild#1971netliomax25-code wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
1 participant
YGNodeSwapChild forwards its index straight to Node::replaceChild, which reads and writes children_[index] with no bounds check, so calling it with an index past the last child reads and writes a Node* outside the children vector. YGNodeInsertChild has the same gap, where an index greater than the child count builds an invalid insertion iterator and is undefined behavior. Both now validate the index up front the same way YGNodeGetChild already does, rejecting out-of-range values before the vector is touched.