FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

dgram: fix send with out of bounds offset + length by Linkgoron · Pull Request #40568 · nodejs/node · GitHub

/ node Public

dgram: fix send with out of bounds offset + length - #40568

Closed
Linkgoron wants to merge 3 commits into
nodejs:masterfrom
Linkgoron:dgram-fix-str-with-len
ConversationCommits (3)ChecksFiles changed
Closed

dgram: fix send with out of bounds offset + length#40568
Linkgoron wants to merge 3 commits into
nodejs:masterfrom
Linkgoron:dgram-fix-str-with-len

Conversation

Linkgoron commented Oct 22, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor

fix Socket.prototype.send sending garbage when the message is a string, and offset+length is out of bounds.

When a string message was sent with offset/length, the underlying buffer from Buffer.from was sent without checking the original string's length, and garbage was sent if length/offset were too long. Instead, the method now throws an ERR_OUT_OF_RANGE ERR_BUFFER_OUT_OF_BOUNDS error.

Edit:
Also added checks for Buffers

Fixes: #40491

nodejs-github-bot added dgram Issues and PRs related to the dgram subsystem / UDP. needs-ci PRs that need a full CI run. labels Oct 22, 2021
Linkgoron force-pushed the dgram-fix-str-with-len branch from 4e3776a to 6b2f4fc Compare October 22, 2021 17:15

This comment has been minimized.

Sign in to view

This comment has been minimized.

Sign in to view

nodejs-github-bot commented Oct 22, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40407/

mscdex reviewed Oct 22, 2021
View reviewed changes
Comment thread lib/dgram.js Outdated

mscdex commented Oct 22, 2021

Copy link
Copy Markdown
Contributor

Do we need to do the same checks for non-strings as well? The same test file verifies errors are thrown for some ranges, but I'm not sure if it covers all cases.

Linkgoron commented Oct 22, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Do we need to do the same checks for non-strings as well? The same test file verifies errors are thrown for some ranges, but I'm not sure if it covers all cases.

I think you're correct and that the following (for example) might show a similar error:

sock.send(Buffer.from('hello'), 3, 4);

Maybe I should add the check for all inputs.

Linkgoron force-pushed the dgram-fix-str-with-len branch from 6b2f4fc to 3fdfdac Compare October 22, 2021 21:08

Linkgoron commented Oct 22, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Do we need to do the same checks for non-strings as well? The same test file verifies errors are thrown for some ranges, but I'm not sure if it covers all cases.

It looks like in addition to strings, checks for Buffers in general were missing, and I also found a minor edge case for DataView which uses data that it should not use (if byteOffset is used on the DataView, it still uses extra data in the buffer). I've used ERR_BUFFER_OUT_OF_BOUNDS in order to keep the Errors for the covered cases the same as they were in previous versions (instead of ERR_OUT_OF_RANGE).

dgram: fix send with out of bounds offset + length
63a0887 
fix Socket.prototype.send sending garbage when the message is a string,
or Buffer and offset+length is out of bounds.

Fixes: nodejs#40491
Linkgoron force-pushed the dgram-fix-str-with-len branch from 3fdfdac to 63a0887 Compare October 22, 2021 21:15
Linkgoron force-pushed the dgram-fix-str-with-len branch from 3b23094 to b392a94 Compare October 22, 2021 22:06
github-actions Bot mentioned this pull request Oct 23, 2021
Open
31 tasks

nodejs-github-bot commented Oct 23, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40409/

nodejs-github-bot commented Oct 23, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40413/

Mesteery removed the needs-ci PRs that need a full CI run. label Oct 23, 2021

nodejs-github-bot commented Oct 23, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40422/

github-actions Bot mentioned this pull request Oct 24, 2021
Open
31 tasks
Linkgoron force-pushed the dgram-fix-str-with-len branch from dcde72f to c829552 Compare October 24, 2021 16:40

nodejs-github-bot commented Oct 24, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40448/

nodejs-github-bot commented Oct 24, 2021 •
edited by Linkgoron
Loading

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40450/ ✅

github-actions Bot mentioned this pull request Oct 25, 2021
Open
24 tasks
Linkgoron added the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label Oct 25, 2021
VoltrexKeyva added the commit-queue Add this label to land a pull request using GitHub Actions. label Oct 25, 2021
github-actions Bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Oct 25, 2021

github-actions Bot commented Oct 25, 2021

Copy link
Copy Markdown
Contributor

Landed in 3b9044b...2413283

github-actions Bot closed this Oct 25, 2021
nodejs-github-bot pushed a commit that referenced this pull request Oct 25, 2021
dgram: fix send with out of bounds offset + length
2413283 
fix Socket.prototype.send sending garbage when the message is a string,
or Buffer and offset+length is out of bounds.

Fixes: #40491

PR-URL: #40568
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
This was referenced Oct 26, 2021
Open
Open
Open
Open
targos pushed a commit that referenced this pull request Nov 6, 2021
dgram: fix send with out of bounds offset + length
79bf429 
fix Socket.prototype.send sending garbage when the message is a string,
or Buffer and offset+length is out of bounds.

Fixes: #40491

PR-URL: #40568
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
targos mentioned this pull request Nov 8, 2021
Merged
BethGriggs pushed a commit that referenced this pull request Nov 25, 2021
dgram: fix send with out of bounds offset + length
23d11a1 
fix Socket.prototype.send sending garbage when the message is a string,
or Buffer and offset+length is out of bounds.

Fixes: #40491

PR-URL: #40568
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
BethGriggs mentioned this pull request Nov 26, 2021
Merged
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

jasnell jasnell approved these changes
benjamingr benjamingr approved these changes
cjihrig cjihrig approved these changes
+1 more reviewer
mscdex mscdex left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no outstanding review comments, and a CI started. dgram Issues and PRs related to the dgram subsystem / UDP.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

UDP socket sends garbage when excess length is specified

8 participants

Back | FazBrowse Home | New Git URL