Skip to content

Commit

Permalink
connection: check that method arguments exist
Browse files Browse the repository at this point in the history
The common implementation of `application.callMethod()` involves
checking `args.length` which leads to crash if `args` is null or
undefined.  This commit provides a quick-and-dirty patch for only
this vulnerability until the common approach for message sanity
checking will have been developed.

PR-URL: #100
  • Loading branch information
aqrln authored and belochub committed Jan 22, 2018
1 parent 18eae58 commit c5dcd5d
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions lib/connection.js
Original file line number Diff line number Diff line change
Expand Up @@ -475,6 +475,10 @@ Connection.prototype._processCallPacket = function(packet, keys) {

const callback = this._remoteCallbackWrapper.bind(this, packetId);

if (!args) {
return callback(errors.ERR_INVALID_SIGNATURE);
}

try {
this.application.callMethod(this,
interfaceName, methodName, args, callback);
Expand Down

0 comments on commit c5dcd5d

Please sign in to comment.