Commit a7f90ee
zlib: validate write_result array length
Fixes: #61286
PR-URL: #61342
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>1 parent ceed42e commit a7f90ee
1 file changed
Lines changed: 3 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -732,6 +732,7 @@ class ZlibStream final : public CompressionStream<ZlibContext> { | |||
| 732 | 732 | ||
| 733 | 733 | CHECK(args[4]->IsUint32Array()); | |
| 734 | 734 | Local<Uint32Array> array = args[4].As<Uint32Array>(); | |
| 735 | + CHECK_GE(array->Length(), 2); | ||
| 735 | 736 | Local<ArrayBuffer> ab = array->Buffer(); | |
| 736 | 737 | uint32_t* write_result = static_cast<uint32_t*>(ab->Data()); | |
| 737 | 738 | ||
@@ -805,6 +806,7 @@ class BrotliCompressionStream final : | |||
| 805 | 806 | CHECK(args.Length() == 3 && "init(params, writeResult, writeCallback)"); | |
| 806 | 807 | ||
| 807 | 808 | CHECK(args[1]->IsUint32Array()); | |
| 809 | + CHECK_GE(args[1].As<Uint32Array>()->Length(), 2); | ||
| 808 | 810 | uint32_t* write_result = reinterpret_cast<uint32_t*>(Buffer::Data(args[1])); | |
| 809 | 811 | ||
| 810 | 812 | CHECK(args[2]->IsFunction()); | |
@@ -886,6 +888,7 @@ class ZstdStream final : public CompressionStream<CompressionContext> { | |||
| 886 | 888 | ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This()); | |
| 887 | 889 | ||
| 888 | 890 | CHECK(args[2]->IsUint32Array()); | |
| 891 | + CHECK_GE(args[2].As<Uint32Array>()->Length(), 2); | ||
| 889 | 892 | uint32_t* write_result = reinterpret_cast<uint32_t*>(Buffer::Data(args[2])); | |
| 890 | 893 | ||
| 891 | 894 | CHECK(args[3]->IsFunction()); | |
0 commit comments