Commit 5fda095
buffer: validate copyArrayBuffer offsets against buffer length
CopyArrayBuffer() computed `byteLength - offset` in unsigned arithmetic
before its CHECK_GE bounds check. An offset greater than the buffer
length wrapped the subtraction to a near-SIZE_MAX value, so the check
passed and memcpy() copied out of bounds.
process.binding('buffer').copyArrayBuffer() is an internal, trusted
binding; the only in-tree caller, the Web Streams BYOB reader, already
validates the offsets in JS. Assert the offsets are within bounds with
CHECK_LE before the subtractions so the invariant holds regardless of
caller, matching the CHECK-based style already used here.
Signed-off-by: Ilia Alshanetsky <ilia@ilia.ws>
PR-URL: #63904
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>1 parent 12170c3 commit 5fda095
1 file changed
Lines changed: 4 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1625,6 +1625,10 @@ void CopyArrayBuffer(const FunctionCallbackInfo<Value>& args) { | |||
| 1625 | 1625 | uint32_t source_offset = args[3].As<Uint32>()->Value(); | |
| 1626 | 1626 | size_t bytes_to_copy = args[4].As<Uint32>()->Value(); | |
| 1627 | 1627 | ||
| 1628 | + // Assert the offsets are within bounds before the subtractions below, which | ||
| 1629 | + // would otherwise underflow and defeat the bytes_to_copy bounds checks. | ||
| 1630 | + CHECK_LE(destination_offset, destination_byte_length); | ||
| 1631 | + CHECK_LE(source_offset, source_byte_length); | ||
| 1628 | 1632 | CHECK_GE(destination_byte_length - destination_offset, bytes_to_copy); | |
| 1629 | 1633 | CHECK_GE(source_byte_length - source_offset, bytes_to_copy); | |
| 1630 | 1634 | ||
0 commit comments