CVE-2024-38375 (C++, published 2024-06-26T19:15Z)
Description: value: @fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fastly/js-compute-runtime
Files changed:
runtime/fastly/host-api/component/fastly_world_adapter.cpp
runtime/js-compute-runtime/host_interface/component/fastly_world_adapter.cpp
Commit message: fix: Fix uses of cabi_realloc that were discarding their results (#811)

Fix issues in some host calls where a buffer length error was being handled by reallocating to the new buffer size, but was discarding the new buffer's pointer. This should also fix flaky tests in CI.

Vulnerable code:
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
}
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
    cabi_realloc(ret->ptr, default_size, 4, ret->len);
}

Fixed code:
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
}
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
}