-
Notifications
You must be signed in to change notification settings - Fork 15.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: libc++ buffer overflow in string_view ctor
- Loading branch information
1 parent
dd0e744
commit bdb5238
Showing
2 changed files
with
41 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
40 changes: 40 additions & 0 deletions
40
patches/node/fix_libc_buffer_overflow_in_string_view_ctor.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,40 @@ | ||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
From: Shelley Vohr <shelley.vohr@gmail.com> | ||
Date: Tue, 18 Apr 2023 11:24:59 +0200 | ||
Subject: fix: libc++ buffer overflow in string_view ctor | ||
|
||
Refs https://github.com/nodejs/node/pull/46410 | ||
Refs https://github.com/llvm/llvm-project/issues/61100. | ||
|
||
Fixes a buffer overflow crash in std::string view constructor. This | ||
happens as a result of a limitation of libc++'s implementation of the | ||
string_view constructor. If string_view receives a pointer to a string start point, | ||
and then a length as a size_t, the spec says that a size_t that exceeds the length | ||
of the null terminated string found at pointer only be read up until the null terminator. | ||
|
||
However, Chromium's implementation however does a hard check that this length is less than | ||
or equal to static_cast<size_t>(std::numeric_limits<std::ptrdiff_t>::max()): | ||
https://source.chromium.org/chromium/chromium/src/+/main:buildtools/third_party/libc++/trunk/include/string_view;drc=1718a75513d114e6b9aa4474e5c55d8dabee92fb;l=309 | ||
|
||
This doesn't break in Node.js right now because that hard assert is missing, but will | ||
break in the next version of Xcode that's shipped and this Node.js too. | ||
|
||
This should be upstreamed to ada. | ||
|
||
diff --git a/deps/ada/ada.cpp b/deps/ada/ada.cpp | ||
index 8b2cdd38ad0bb1e5757cdf5724c5a5917fc8e577..fb8d4f56fc92c74b21e372d0aecd085993f63f92 100644 | ||
--- a/deps/ada/ada.cpp | ||
+++ b/deps/ada/ada.cpp | ||
@@ -825,8 +825,10 @@ namespace ada::helpers { | ||
|
||
// Let path be url’s path. | ||
// If url’s scheme is "file", path’s size is 1, and path[0] is a normalized Windows drive letter, then return. | ||
- if (type == ada::scheme::type::FILE && first_delimiter == std::string_view::npos) { | ||
- if (checkers::is_normalized_windows_drive_letter(std::string_view(path.data() + 1, first_delimiter - 1))) { | ||
+ if (path.length() && type == ada::scheme::type::FILE && | ||
+ first_delimiter == std::string_view::npos) { | ||
+ if (checkers::is_normalized_windows_drive_letter( | ||
+ std::string_view(path.data() + 1, path.length() - 1))) { | ||
return; | ||
} | ||
} |