{{ message }}
Commit 5fda095
buffer: validate copyArrayBuffer offsets against buffer length
CopyArrayBuffer() computed `byteLength - offset` in unsigned arithmetic
before its CHECK_GE bounds check. An offset greater than the buffer
length wrapped the subtraction to a near-SIZE_MAX value, so the check
passed and memcpy() copied out of bounds.
process.binding('buffer').copyArrayBuffer() is an internal, trusted
binding; the only in-tree caller, the Web Streams BYOB reader, already
validates the offsets in JS. Assert the offsets are within bounds with
CHECK_LE before the subtractions so the invariant holds regardless of
caller, matching the CHECK-based style already used here.
Signed-off-by: Ilia Alshanetsky <ilia@ilia.ws>
PR-URL: #63904
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>1 parent 12170c3 commit 5fda095
1 file changed
Lines changed: 4 additions & 0 deletions
0 commit comments