From ef83723f479fce6a26d654c791055b8b06afb54b Mon Sep 17 00:00:00 2001 From: Xavier Stouder Date: Tue, 16 May 2023 13:05:43 +0200 Subject: [PATCH 1/6] buffer: use size_t instead of uint32_t to avoid segmentation fault Fixes: https://github.com/nodejs/node/issues/46836 --- src/string_bytes.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/string_bytes.cc b/src/string_bytes.cc index c6ebcf89c4058b..0c3ca98eaf2635 100644 --- a/src/string_bytes.cc +++ b/src/string_bytes.cc @@ -631,7 +631,7 @@ size_t StringBytes::hex_encode( "not enough space provided for hex encode"); dlen = slen * 2; - for (uint32_t i = 0, k = 0; k < dlen; i += 1, k += 2) { + for (size_t i = 0, k = 0; k < dlen; i += 1, k += 2) { static const char hex[] = "0123456789abcdef"; uint8_t val = static_cast(src[i]); dst[k + 0] = hex[val >> 4]; From 855fd367cea8a83aa38c9602259e5c1addd53215 Mon Sep 17 00:00:00 2001 From: Xavier Stouder Date: Thu, 25 May 2023 20:41:54 +0200 Subject: [PATCH 2/6] fix: fix another potential overflow --- src/string_bytes.cc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/string_bytes.cc b/src/string_bytes.cc index 0c3ca98eaf2635..8b3d6b1ac650ee 100644 --- a/src/string_bytes.cc +++ b/src/string_bytes.cc @@ -626,10 +626,14 @@ size_t StringBytes::hex_encode( size_t slen, char* dst, size_t dlen) { + + CHECK(slen * 2 >= slen && "overflow in hex encode"); + // We know how much we'll write, just make sure that there's space. CHECK(dlen >= slen * 2 && "not enough space provided for hex encode"); + dlen = slen * 2; for (size_t i = 0, k = 0; k < dlen; i += 1, k += 2) { static const char hex[] = "0123456789abcdef"; From ca4471a202400490a3229ce8d4e99f11df380258 Mon Sep 17 00:00:00 2001 From: Xavier Stouder Date: Thu, 25 May 2023 20:42:53 +0200 Subject: [PATCH 3/6] fix: remove blankline --- src/string_bytes.cc | 1 - 1 file changed, 1 deletion(-) diff --git a/src/string_bytes.cc b/src/string_bytes.cc index 8b3d6b1ac650ee..ae994cd34e185d 100644 --- a/src/string_bytes.cc +++ b/src/string_bytes.cc @@ -633,7 +633,6 @@ size_t StringBytes::hex_encode( CHECK(dlen >= slen * 2 && "not enough space provided for hex encode"); - dlen = slen * 2; for (size_t i = 0, k = 0; k < dlen; i += 1, k += 2) { static const char hex[] = "0123456789abcdef"; From 98d8590d46a92bcf062ffe6db655ce85b7e10f0a Mon Sep 17 00:00:00 2001 From: Xavier Stouder Date: Thu, 25 May 2023 20:52:04 +0200 Subject: [PATCH 4/6] fix: format cpp --- src/string_bytes.cc | 1 - 1 file changed, 1 deletion(-) diff --git a/src/string_bytes.cc b/src/string_bytes.cc index ae994cd34e185d..d6b4a1fee00856 100644 --- a/src/string_bytes.cc +++ b/src/string_bytes.cc @@ -626,7 +626,6 @@ size_t StringBytes::hex_encode( size_t slen, char* dst, size_t dlen) { - CHECK(slen * 2 >= slen && "overflow in hex encode"); // We know how much we'll write, just make sure that there's space. From d80d6cab27b24690bc67ed4e01f9b04bfbbbf859 Mon Sep 17 00:00:00 2001 From: James M Snell Date: Sat, 23 Dec 2023 08:43:34 -0800 Subject: [PATCH 5/6] Apply suggestions from code review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Tobias Nießen --- src/string_bytes.cc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/string_bytes.cc b/src/string_bytes.cc index d6b4a1fee00856..f7870d812b11b3 100644 --- a/src/string_bytes.cc +++ b/src/string_bytes.cc @@ -626,10 +626,8 @@ size_t StringBytes::hex_encode( size_t slen, char* dst, size_t dlen) { - CHECK(slen * 2 >= slen && "overflow in hex encode"); - // We know how much we'll write, just make sure that there's space. - CHECK(dlen >= slen * 2 && + CHECK(dlen >= MultiplyWithOverflowCheck(slen, 2u) && "not enough space provided for hex encode"); dlen = slen * 2; From 62f99dcdb34312f8211cc514fc66e19aefad6aad Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 11 May 2024 11:19:57 +0200 Subject: [PATCH 6/6] format_cpp --- src/string_bytes.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/string_bytes.cc b/src/string_bytes.cc index f7870d812b11b3..6b9d1b41a9fba3 100644 --- a/src/string_bytes.cc +++ b/src/string_bytes.cc @@ -628,7 +628,7 @@ size_t StringBytes::hex_encode( size_t dlen) { // We know how much we'll write, just make sure that there's space. CHECK(dlen >= MultiplyWithOverflowCheck(slen, 2u) && - "not enough space provided for hex encode"); + "not enough space provided for hex encode"); dlen = slen * 2; for (size_t i = 0, k = 0; k < dlen; i += 1, k += 2) {