archive/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2025-08-15 21:58:48 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

napi: fix memory corruption vulnerability

Browse source 
Fixes: https://hackerone.com/reports/784186
CVE-ID: CVE-2020-8174
PR-URL: https://github.com/nodejs-private/node-private/pull/195
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
This commit is contained in:
Tobias Nießen 2020-01-27 13:38:36 -04:00 • committed by Michaël Zasso
parent 0cb194ec6a
commit 656260b4b6
No known key found for this signature in database
GPG key ID: 770F7A9A5AE15600
3 changed files with 31 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
test/js-native-api/test_string/test_string.c
View file

@ -1,4 +1,5 @@
#include <limits.h> // INT_MAX
#include <string.h>
#include <js_native_api.h>
#include "../common.h"
@ -244,6 +245,24 @@ static napi_value TestLargeUtf16(napi_env env, napi_callback_info info) {
return output;
}
static napi_value TestMemoryCorruption(napi_env env, napi_callback_info info) {
size_t argc = 1;
napi_value args[1];
NAPI_CALL(env, napi_get_cb_info(env, info, &argc, args, NULL, NULL));
NAPI_ASSERT(env, argc == 1, "Wrong number of arguments");
char buf[10] = { 0 };
NAPI_CALL(env, napi_get_value_string_utf8(env, args[0], buf, 0, NULL));
char zero[10] = { 0 };
if (memcmp(buf, zero, sizeof(buf)) != 0) {
NAPI_CALL(env, napi_throw_error(env, NULL, "Buffer overwritten"));
}
return NULL;
}
EXTERN_C_START
napi_value Init(napi_env env, napi_value exports) {
napi_property_descriptor properties[] = {
@ -258,6 +277,7 @@ napi_value Init(napi_env env, napi_value exports) {
DECLARE_NAPI_PROPERTY("TestLargeUtf8", TestLargeUtf8),
DECLARE_NAPI_PROPERTY("TestLargeLatin1", TestLargeLatin1),
DECLARE_NAPI_PROPERTY("TestLargeUtf16", TestLargeUtf16),
DECLARE_NAPI_PROPERTY("TestMemoryCorruption", TestMemoryCorruption),
};
NAPI_CALL(env, napi_define_properties(