http2: do not crash on mismatched ping buffer length

Renegade334 · aduh95 · commit 2ccc9a6205d8 · 2026-02-17T15:06:03.000+01:00
PR-URL: #60135 Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
@@ -1453,9 +1453,9 @@ class Http2Session extends EventEmitter {
     }
     if (payload) {
       validateBuffer(payload, 'payload');
-    }
-    if (payload && payload.length !== 8) {
-      throw new ERR_HTTP2_PING_LENGTH();
+      if (payload.byteLength !== 8) {
+        throw new ERR_HTTP2_PING_LENGTH();
+      }
     }
     validateFunction(callback, 'callback');
 
diff --git a/test/parallel/test-http2-ping.js b/test/parallel/test-http2-ping.js
@@ -64,11 +64,11 @@ server.listen(0, common.mustCall(() => {
       })));
     }
     {
-      const payload = Buffer.from('abcdefgi');
+      const payload = new Uint16Array([1, 2, 3, 4]);
       assert(client.ping(payload, common.mustCall((err, duration, ret) => {
         assert.strictEqual(err, null);
         assert.strictEqual(typeof duration, 'number');
-        assert.deepStrictEqual(payload, ret);
+        assert.deepStrictEqual(payload.buffer, ret.buffer);
       })));
     }
 
@@ -99,7 +99,8 @@ server.listen(0, common.mustCall(() => {
     {
       const shortPayload = Buffer.from('abcdefg');
       const longPayload = Buffer.from('abcdefghi');
-      [shortPayload, longPayload].forEach((payloadWithInvalidLength) =>
+      const mismatchedPayload = new Uint32Array(8);
+      [shortPayload, longPayload, mismatchedPayload].forEach((payloadWithInvalidLength) =>
         assert.throws(
           () => client.ping(payloadWithInvalidLength),
           {

Original file line number	Diff line number	Diff line change
`@@ -1453,9 +1453,9 @@ class Http2Session extends EventEmitter {`
`1453`	`1453`	`}`
`1454`	`1454`	`if (payload) {`
`1455`	`1455`	`validateBuffer(payload, 'payload');`
`1456`		`- }`
`1457`		`- if (payload && payload.length !== 8) {`
`1458`		`- throw new ERR_HTTP2_PING_LENGTH();`
	`1456`	`+ if (payload.byteLength !== 8) {`
	`1457`	`+ throw new ERR_HTTP2_PING_LENGTH();`
	`1458`	`+ }`
`1459`	`1459`	`}`
`1460`	`1460`	`validateFunction(callback, 'callback');`
`1461`	`1461`
Original file line number	Diff line number	Diff line change
`@@ -64,11 +64,11 @@ server.listen(0, common.mustCall(() => {`
`64`	`64`	`})));`
`65`	`65`	`}`
`66`	`66`	`{`
`67`		`- const payload = Buffer.from('abcdefgi');`
	`67`	`+ const payload = new Uint16Array([1, 2, 3, 4]);`
`68`	`68`	`assert(client.ping(payload, common.mustCall((err, duration, ret) => {`
`69`	`69`	`assert.strictEqual(err, null);`
`70`	`70`	`assert.strictEqual(typeof duration, 'number');`
`71`		`- assert.deepStrictEqual(payload, ret);`
	`71`	`+ assert.deepStrictEqual(payload.buffer, ret.buffer);`
`72`	`72`	`})));`
`73`	`73`	`}`
`74`	`74`
`@@ -99,7 +99,8 @@ server.listen(0, common.mustCall(() => {`
`99`	`99`	`{`
`100`	`100`	`const shortPayload = Buffer.from('abcdefg');`
`101`	`101`	`const longPayload = Buffer.from('abcdefghi');`
`102`		`- [shortPayload, longPayload].forEach((payloadWithInvalidLength) =>`
	`102`	`+ const mismatchedPayload = new Uint32Array(8);`
	`103`	`+ [shortPayload, longPayload, mismatchedPayload].forEach((payloadWithInvalidLength) =>`
`103`	`104`	`assert.throws(`
`104`	`105`	`() => client.ping(payloadWithInvalidLength),`
`105`	`106`	`{`