Commit 2679b62
authored
zlib: validate write_result array length
Fixes: #61286
PR-URL: #61342
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>1 parent 1409ac4 commit 2679b62
1 file changed
Lines changed: 3 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -736,6 +736,7 @@ class ZlibStream final : public CompressionStream<ZlibContext> { | |||
| 736 | 736 | ||
| 737 | 737 | CHECK(args[4]->IsUint32Array()); | |
| 738 | 738 | Local<Uint32Array> array = args[4].As<Uint32Array>(); | |
| 739 | + CHECK_GE(array->Length(), 2); | ||
| 739 | 740 | Local<ArrayBuffer> ab = array->Buffer(); | |
| 740 | 741 | uint32_t* write_result = static_cast<uint32_t*>(ab->Data()); | |
| 741 | 742 | ||
@@ -809,6 +810,7 @@ class BrotliCompressionStream final : | |||
| 809 | 810 | CHECK(args.Length() == 3 && "init(params, writeResult, writeCallback)"); | |
| 810 | 811 | ||
| 811 | 812 | CHECK(args[1]->IsUint32Array()); | |
| 813 | + CHECK_GE(args[1].As<Uint32Array>()->Length(), 2); | ||
| 812 | 814 | uint32_t* write_result = reinterpret_cast<uint32_t*>(Buffer::Data(args[1])); | |
| 813 | 815 | ||
| 814 | 816 | CHECK(args[2]->IsFunction()); | |
@@ -890,6 +892,7 @@ class ZstdStream final : public CompressionStream<CompressionContext> { | |||
| 890 | 892 | ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This()); | |
| 891 | 893 | ||
| 892 | 894 | CHECK(args[2]->IsUint32Array()); | |
| 895 | + CHECK_GE(args[2].As<Uint32Array>()->Length(), 2); | ||
| 893 | 896 | uint32_t* write_result = reinterpret_cast<uint32_t*>(Buffer::Data(args[2])); | |
| 894 | 897 | ||
| 895 | 898 | CHECK(args[3]->IsFunction()); | |
0 commit comments