Csaba Osztrogonác de38764e88
Fix heap buffer overflow in Array.prototype.copyWithin (#4211)
2nd and 3rd argument evaluation of Array.prototype.copyWithin can change
the length of the array as a side-effect. But ES11 spec says that the
algorithm should use the original length. In this case it could happen
that the underlying buffer should be extended.

Fixes #4204

JerryScript-DCO-1.0-Signed-off-by: Csaba Osztrogonác csaba.osztrogonac@h-lab.eu
2020-09-25 15:06:29 +02:00
..