net: fix crash if POLLHUP is received

santigimeno · targos · commit dd74601f962a · 2020-04-11T10:12:55.000+02:00
If the `onread` socket option is used and a `POLLHUP` event is received, libuv returns `UV_EOF` along with a `NULL` buffer in the read callback, causing the crash. Deal with this case. Fixes: #31823 PR-URL: #32590 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/src/stream_base.cc b/src/stream_base.cc
@@ -517,13 +517,21 @@ uv_buf_t CustomBufferJSListener::OnStreamAlloc(size_t suggested_size) {
 
 void CustomBufferJSListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
   CHECK_NOT_NULL(stream_);
-  CHECK_EQ(buf.base, buffer_.base);
 
   StreamBase* stream = static_cast<StreamBase*>(stream_);
   Environment* env = stream->stream_env();
   HandleScope handle_scope(env->isolate());
   Context::Scope context_scope(env->context());
 
+  // To deal with the case where POLLHUP is received and UV_EOF is returned, as
+  // libuv returns an empty buffer (on unices only).
+  if (nread == UV_EOF && buf.base == nullptr) {
+    stream->CallJSOnreadMethod(nread, Local<ArrayBuffer>());
+    return;
+  }
+
+  CHECK_EQ(buf.base, buffer_.base);
+
   MaybeLocal<Value> ret = stream->CallJSOnreadMethod(nread,
                              Local<ArrayBuffer>(),
                              0,
