zlib: validate pledgedSrcSize as a safe integer · nodejs/node@f322870 · GitHub
Skip to content

Commit f322870

Browse files
Archkonaduh95
authored andcommitted
zlib: validate pledgedSrcSize as a safe integer
pledgedSrcSize represents an exact byte count. Reject values that are not non-negative safe integers instead of silently ignoring or coercing them through IntegerValue(). Apply the same validation to zlib/iter and retain a native validation check for internal callers. Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com> PR-URL: #64604 Fixes: #64603 Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Jan Martin <jan.krems@gmail.com>
1 parent 6879aa4 commit f322870

6 files changed

Lines changed: 65 additions & 26 deletions

File tree

doc/api/zlib.md

Lines changed: 5 additions & 3 deletions

lib/internal/streams/iter/transform.js

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -257,16 +257,6 @@ function createZstdHandle(mode, options, processCallback, onError) {
257257
validateParams(options.params, maxParam, ERR_ZSTD_INVALID_PARAM);
258258

259259
const pledgedSrcSize = options.pledgedSrcSize;
260-
if (pledgedSrcSize !== undefined) {
261-
if (typeof pledgedSrcSize !== 'number' || NumberIsNaN(pledgedSrcSize)) {
262-
throw new ERR_INVALID_ARG_TYPE('options.pledgedSrcSize', 'number',
263-
pledgedSrcSize);
264-
}
265-
if (pledgedSrcSize < 0) {
266-
throw new ERR_OUT_OF_RANGE('options.pledgedSrcSize', '>= 0',
267-
pledgedSrcSize);
268-
}
269-
}
270260

271261
const handle = isCompress ?
272262
new binding.ZstdCompress() : new binding.ZstdDecompress();

lib/zlib.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -939,7 +939,7 @@ class Zstd extends ZlibBase {
939939
const handle = mode === ZSTD_COMPRESS ?
940940
new binding.ZstdCompress() : new binding.ZstdDecompress();
941941

942-
const pledgedSrcSize = opts?.pledgedSrcSize ?? undefined;
942+
const pledgedSrcSize = opts?.pledgedSrcSize;
943943

944944
const writeState = new Uint32Array(2);
945945

src/node_zlib.cc

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -945,9 +945,6 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
945945
}
946946

947947
static void Init(const FunctionCallbackInfo<Value>& args) {
948-
Environment* env = Environment::GetCurrent(args);
949-
Local<Context> context = env->context();
950-
951948
CHECK((args.Length() == 4 || args.Length() == 5) &&
952949
"init(params, pledgedSrcSize, writeResult, writeCallback[, "
953950
"dictionary])");
@@ -964,19 +961,24 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
964961
wrap->InitStream(write_result, write_js_callback);
965962

966963
uint64_t pledged_src_size = ZSTD_CONTENTSIZE_UNKNOWN;
967-
if (args[1]->IsNumber()) {
968-
int64_t signed_pledged_src_size;
969-
if (!args[1]->IntegerValue(context).To(&signed_pledged_src_size)) {
970-
THROW_ERR_INVALID_ARG_VALUE(wrap->env(),
971-
"pledgedSrcSize should be an integer");
964+
if (!args[1]->IsUndefined()) {
965+
if (!args[1]->IsNumber()) {
966+
THROW_ERR_INVALID_ARG_TYPE(wrap->env(),
967+
"pledgedSrcSize must be a number");
968+
return;
969+
}
970+
if (!IsSafeJsInt(args[1])) {
971+
THROW_ERR_OUT_OF_RANGE(wrap->env(),
972+
"pledgedSrcSize must be a safe integer");
972973
return;
973974
}
975+
const int64_t signed_pledged_src_size = args[1].As<Integer>()->Value();
974976
if (signed_pledged_src_size < 0) {
975-
THROW_ERR_INVALID_ARG_VALUE(wrap->env(),
976-
"pledgedSrcSize may not be negative");
977+
THROW_ERR_OUT_OF_RANGE(wrap->env(),
978+
"pledgedSrcSize must be non-negative");
977979
return;
978980
}
979-
pledged_src_size = signed_pledged_src_size;
981+
pledged_src_size = static_cast<uint64_t>(signed_pledged_src_size);
980982
}
981983

982984
AllocScope alloc_scope(wrap);

test/parallel/test-stream-iter-validation.js

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -353,7 +353,16 @@ async function testAsyncValidation() {
353353

354354
// Zstd pledgedSrcSize
355355
await assert.rejects(consume(compressZstd({ pledgedSrcSize: 'bad' })), TYPE);
356-
await assert.rejects(consume(compressZstd({ pledgedSrcSize: -1 })), RANGE);
356+
for (const pledgedSrcSize of [
357+
NaN,
358+
Infinity,
359+
-Infinity,
360+
1.9,
361+
-1,
362+
Number.MAX_SAFE_INTEGER + 1,
363+
]) {
364+
await assert.rejects(consume(compressZstd({ pledgedSrcSize })), RANGE);
365+
}
357366
}
358367

359368
// =============================================================================

test/parallel/test-zlib-zstd-pledged-src-size.js

Lines changed: 36 additions & 0 deletions

0 commit comments

Comments
 (0)