src: fix UB in InternalModuleReadFile() - #16871
Merged
bnoordhuis merged 0 commit intoNov 9, 2017
Merged
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
cjihrig
approved these changes
Nov 7, 2017
addaleax
approved these changes
Nov 7, 2017
jasnell
reviewed
Nov 8, 2017
Comment thread
test/parallel/test-module-binding.js
Outdated
Copy link
Copy Markdown
Member
There was a problem hiding this comment.
unblocking nit: for consistency...
const fixtures = require('../common/fixtures');
/* ... */
strictEqual(internalModuleReadFile(fixtures.path('empty-with-bom.txt'));
Sorry, something went wrong.
jasnell
approved these changes
Nov 8, 2017
fhinkel
approved these changes
Nov 9, 2017
bnoordhuis
force-pushed
the
fix-module-ub
branch
from
2edbadf to
72e23a4
Compare
November 9, 2017 10:58
Copy link
Copy Markdown
Member
Author
|
Updated test. New CI: https://ci.nodejs.org/job/node-test-pull-request/11322/ |
Sorry, something went wrong.
bnoordhuis
force-pushed
the
fix-module-ub
branch
from
72e23a4 to
f823d38
Compare
November 9, 2017 11:59
evanlucas
pushed a commit
that referenced
this pull request
Nov 13, 2017
`&vec[0]` is undefined behavior when `vec.size() == 0`. It is mostly academic because package.json files are not usually empty and because with most STL implementations it decays to something that is legal C++ as long as the result is not dereferenced, but better safe than sorry. Note that the tests don't actually fail because of that, I added them as sanity checks. PR-URL: #16871 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Merged
Copy link
Copy Markdown
Contributor
|
Should this land on v8.x or v6.x? It lands cleanly on 8.x, but will require a backport for v6.x |
Sorry, something went wrong.
Copy link
Copy Markdown
Member
|
@MylesBorins it’s not worth the trouble of backporting I’d say (not that I’d want to stop @bnoordhuis from doing that), but if it lands cleanly it should probably go into v8.x |
Sorry, something went wrong.
gibfahn
pushed a commit
that referenced
this pull request
Dec 13, 2017
`&vec[0]` is undefined behavior when `vec.size() == 0`. It is mostly academic because package.json files are not usually empty and because with most STL implementations it decays to something that is legal C++ as long as the result is not dereferenced, but better safe than sorry. Note that the tests don't actually fail because of that, I added them as sanity checks. PR-URL: #16871 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
&vec[0] is undefined behavior when vec.size() == 0.
It is mostly academic because package.json files are not usually empty
and because with most STL implementations it decays to something that
is legal C++ as long as the result is not dereferenced, but better safe
than sorry.
Note that the tests don't actually fail because of that, I added them
as sanity checks.
Split off from #15767 where it already had a couple of LGTMs.
CI: https://ci.nodejs.org/job/node-test-pull-request/11283/