src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR · nodejs/node@44976c6 · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 635
• Pull requests 750
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit 44976c6

Browse filesBrowse the repository at this point in the historyBrowse files

ndossche

authored and

aduh95

committed

src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR

This function call can fail with `Z_VERSION_ERROR` if the compiled library vs loaded library mismatched in version number or in stream structure size. In those cases, zlib doesn't initialize the `strm_.msg` field to null. Therefore, when a `CompressionError` object is created via `ErrorForMessage()`, it can read a stale or uninitialized `strm_.msg` pointer that will cause a crash. Example ASAN report: ``` AddressSanitizer: SEGV on unknown address #0 __strlen_avx2 string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76 #1 strlen (/work/node/out/Debug/node+0x1a42ab7) #2 v8::(anonymous namespace)::StringLength(char const*) /work/node/out/../deps/v8/src/api/api.cc:7581:16 #3 v8::(anonymous namespace)::StringLength(unsigned char const*) /work/node/out/../deps/v8/src/api/api.cc:7587:10 #4 v8::String::NewFromOneByte(v8::Isolate*, unsigned char const*, v8::NewStringType, int) /work/node/out/../deps/v8/src/api/api.cc:7677:3 #5 node::OneByteString(v8::Isolate*, char const*, int, v8::NewStringType) /work/node/out/../src/util-inl.h:166:10 #6 node::(anonymous namespace)::CompressionStream< node::(anonymous namespace)::ZlibContext> ::EmitError(node::(anonymous namespace) ::CompressionError const&) /work/node/out/../src/node_zlib.cc:565:7 #7 node::(anonymous namespace)::CompressionStream< node::(anonymous namespace)::ZlibContext> ::CheckError() /work/node/out/../src/node_zlib.cc:519:5 #8 node::(anonymous namespace)::CompressionStream< node::(anonymous namespace)::ZlibContext> ::AfterThreadPoolWork(int) /work/node/out/../src/node_zlib.cc:543:10 #9 node::ThreadPoolWork::ScheduleWork() ::'lambda'(uv_work_s*, int) ::operator()(uv_work_s*, int) const /work/node/out/../src/threadpoolwork-inl.h:57:15 #10 node::ThreadPoolWork::ScheduleWork() ::'lambda'(uv_work_s*, int) ::__invoke(uv_work_s*, int) /work/node/out/../src/threadpoolwork-inl.h:48:7 #11 uv__work_done /work/libuv-1.51.0/src/threadpool.c:330:5 #12 uv__async_io.part.0 /work/libuv-1.51.0/src/unix/async.c:208:5 ``` Signed-off-by: ndossche <nora.dossche@ugent.be> PR-URL: #63476 Reviewed-By: Anna Henningsen <anna@addaleax.net>

1 parent b4f5c86 commit 44976c6
Copy full SHA for 44976c6

1 file changed

+5Lines changed: 5 additions & 0 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• src
  • node_zlib.cc

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎src/node_zlib.cc‎

Copy file name to clipboardExpand all lines: src/node_zlib.cc

+5Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -1289,6 +1289,11 @@ bool ZlibContext::InitZlib() {
1289	1289	return false;
1290	1290	}
1291	1291
	1292	+ // If deflateInit2() fails with Z_VERSION_ERROR, msg remains uninitialized.
	1293	+ // Initialize it here to avoid reading the uninitialized pointer during error
	1294	+ // emission.
	1295	+ strm_.msg = nullptr;
	1296	+
1292	1297	switch (mode_) {
1293	1298	case DEFLATE:
1294	1299	case GZIP:

0 commit comments

Comments

0 (0)