FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

buffer: prevent string write offset overflow · nodejs/node@13e7d54 · GitHub

/ node Public

Commit 13e7d54

Browse files
mcollina
authored and
aduh95
committed
buffer: prevent string write offset overflow
Reject offsets outside the destination buffer before subtracting from its length in SlowWriteString. Normalize wrapper arguments once so validated values reach the native binding. Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #65043 Reviewed-By: Robert Nagy <ronagy@icloud.com>
1 parent 537feec commit 13e7d54

3 files changed

Lines changed: 31 additions & 3 deletions

File tree

‎lib/internal/buffer.js‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -960,30 +960,39 @@ function writeFloatBackwards(val, offset = 0) {
960960

961961
class FastBuffer extends Uint8Array {}
962962

963-
function asciiWrite(buf, string, offset = 0, length = buf.byteLength - offset) {
963+
function asciiWrite(buf, string, offset = 0, length) {
964+
offset = Number(offset);
964965
if (offset < 0 || offset > buf.byteLength) {
965966
throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
966967
}
968+
if (length === undefined) length = buf.byteLength - offset;
969+
else length = Number(length);
967970
if (length < 0 || length > buf.byteLength - offset) {
968971
throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
969972
}
970973
return asciiWriteStatic(buf, string, offset, length);
971974
}
972975

973-
function latin1Write(buf, string, offset = 0, length = buf.byteLength - offset) {
976+
function latin1Write(buf, string, offset = 0, length) {
977+
offset = Number(offset);
974978
if (offset < 0 || offset > buf.byteLength) {
975979
throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
976980
}
981+
if (length === undefined) length = buf.byteLength - offset;
982+
else length = Number(length);
977983
if (length < 0 || length > buf.byteLength - offset) {
978984
throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
979985
}
980986
return latin1WriteStatic(buf, string, offset, length);
981987
}
982988

983-
function utf8Write(buf, string, offset = 0, length = buf.byteLength - offset) {
989+
function utf8Write(buf, string, offset = 0, length) {
990+
offset = Number(offset);
984991
if (offset < 0 || offset > buf.byteLength) {
985992
throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
986993
}
994+
if (length === undefined) length = buf.byteLength - offset;
995+
else length = Number(length);
987996
if (length < 0 || length > buf.byteLength - offset) {
988997
throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
989998
}

‎src/node_buffer.cc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1734,6 +1734,11 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {
17341734
size_t max_length = 0;
17351735

17361736
THROW_AND_RETURN_IF_OOB(ParseArrayIndex(env, args[2], 0, &offset));
1737+
if (offset > ts_obj_length) {
1738+
return node::THROW_ERR_BUFFER_OUT_OF_BOUNDS(
1739+
env, "\"offset\" is outside of buffer bounds");
1740+
}
1741+
17371742
THROW_AND_RETURN_IF_OOB(
17381743
ParseArrayIndex(env, args[3], ts_obj_length - offset, &max_length));
17391744

‎test/parallel/test-buffer-write.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,3 +127,17 @@ assert.throws(() => {
127127
}, common.expectsError({
128128
code: 'ERR_BUFFER_OUT_OF_BOUNDS',
129129
}));
130+
131+
for (const method of ['asciiWrite', 'latin1Write', 'utf8Write']) {
132+
let calls = 0;
133+
const offset = {
134+
valueOf() {
135+
calls++;
136+
return 2;
137+
},
138+
};
139+
assert.throws(() => Buffer.alloc(1)[method]('ww', offset, 1), common.expectsError({
140+
code: 'ERR_BUFFER_OUT_OF_BOUNDS',
141+
}));
142+
assert.strictEqual(calls, 1);
143+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL