Commit 74a22cd
buffer: validate copyArrayBuffer offsets against buffer length
CopyArrayBuffer() computed `byteLength - offset` in unsigned arithmetic
before its CHECK_GE bounds check. An offset greater than the buffer
length wrapped the subtraction to a near-SIZE_MAX value, so the check
passed and memcpy() copied out of bounds.
process.binding('buffer').copyArrayBuffer() is an internal, trusted
binding; the only in-tree caller, the Web Streams BYOB reader, already
validates the offsets in JS. Assert the offsets are within bounds with
CHECK_LE before the subtractions so the invariant holds regardless of
caller, matching the CHECK-based style already used here.
Signed-off-by: Ilia Alshanetsky <ilia@ilia.ws>
PR-URL: #63904
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>1 parent c0dd022 commit 74a22cd
1 file changed
Lines changed: 4 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1567,6 +1567,10 @@ void CopyArrayBuffer(const FunctionCallbackInfo<Value>& args) { | |||
| 1567 | 1567 | uint32_t source_offset = args[3].As<Uint32>()->Value(); | |
| 1568 | 1568 | size_t bytes_to_copy = args[4].As<Uint32>()->Value(); | |
| 1569 | 1569 | ||
| 1570 | + // Assert the offsets are within bounds before the subtractions below, which | ||
| 1571 | + // would otherwise underflow and defeat the bytes_to_copy bounds checks. | ||
| 1572 | + CHECK_LE(destination_offset, destination_byte_length); | ||
| 1573 | + CHECK_LE(source_offset, source_byte_length); | ||
| 1570 | 1574 | CHECK_GE(destination_byte_length - destination_offset, bytes_to_copy); | |
| 1571 | 1575 | CHECK_GE(source_byte_length - source_offset, bytes_to_copy); | |
| 1572 | 1576 | ||
0 commit comments