diff --git a/Cargo.toml b/Cargo.toml index 7c17e3caa..3c2c7b49f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "neon" -version = "0.10.0" +version = "0.10.1" authors = ["Dave Herman "] description = "A safe abstraction layer for Node.js." readme = "README.md" @@ -12,7 +12,7 @@ build = "build.rs" edition = "2018" [build-dependencies] -neon-build = { version = "=0.10.0", path = "crates/neon-build" } +neon-build = { version = "=0.10.1", path = "crates/neon-build" } [dev-dependencies] lazy_static = "1.4.0" @@ -24,8 +24,8 @@ failure = "0.1.5" # used for a doc example [dependencies] semver = "0.9.0" smallvec = "1.4.2" -neon-runtime = { version = "=0.10.0", path = "crates/neon-runtime" } -neon-macros = { version = "=0.10.0", path = "crates/neon-macros", optional = true } +neon-runtime = { version = "=0.10.1", path = "crates/neon-runtime" } +neon-macros = { version = "=0.10.1", path = "crates/neon-macros", optional = true } [features] default = ["legacy-runtime"] diff --git a/RELEASES.md b/RELEASES.md index 1e7b78439..c96bf8cd6 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -1,3 +1,27 @@ +# Version 0.10.1 + +Fix a soundness hole in `JsArrayBuffer::external` +and `JsBuffer::external` (https://github.com/neon-bindings/neon/pull/897). + +Thanks to [@Cassy343](https://github.com/Cassy343) for finding the [issue](https://github.com/neon-bindings/neon/issues/896)! + +In previous versions of Neon, it was possible to create a `JsArrayBuffer` or `JsBuffer` that references data without the `'static` lifetime. + +```rust +pub fn soundness_hole(mut cx: FunctionContext) -> JsResult { + let mut data = vec![0u8, 1, 2, 3]; + + // Creating an external from `&mut [u8]` instead of `Vec` since there is a blanket impl + // of `AsMut for &mut T` + let buf = JsArrayBuffer::external(&mut cx, data.as_mut_slice()); + + // `buf` is still holding a reference to `data`! + drop(data); + + Ok(buf) +} +``` + # Version 0.10 See the [Neon 0.10 Migration Guide](MIGRATION_GUIDE_0.10.md) for more details about new features and breaking changes. diff --git a/cli/package.json b/cli/package.json index 934b9facc..239d9c076 100644 --- a/cli/package.json +++ b/cli/package.json @@ -1,6 +1,6 @@ { "name": "neon-cli", - "version": "0.10.0", + "version": "0.10.1", "description": "Build and load native Rust/Neon modules.", "author": "Dave Herman ", "repository": { diff --git a/crates/neon-build/Cargo.toml b/crates/neon-build/Cargo.toml index aaac20ee3..cfd1f1a5e 100644 --- a/crates/neon-build/Cargo.toml +++ b/crates/neon-build/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "neon-build" -version = "0.10.0" +version = "0.10.1" authors = ["Dave Herman "] description = "Build logic required for Neon projects." repository = "https://github.com/neon-bindings/neon" @@ -9,4 +9,4 @@ edition = "2018" build = "build.rs" [dependencies] -neon-sys = { version = "=0.10.0", path = "../neon-sys", optional = true } +neon-sys = { version = "=0.10.1", path = "../neon-sys", optional = true } diff --git a/crates/neon-macros/Cargo.toml b/crates/neon-macros/Cargo.toml index 0f5880f35..d234e402d 100644 --- a/crates/neon-macros/Cargo.toml +++ b/crates/neon-macros/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "neon-macros" -version = "0.10.0" +version = "0.10.1" authors = ["Dave Herman "] description = "Procedural macros supporting Neon" repository = "https://github.com/neon-bindings/neon" diff --git a/crates/neon-runtime/Cargo.toml b/crates/neon-runtime/Cargo.toml index 65745a685..bb96beab3 100644 --- a/crates/neon-runtime/Cargo.toml +++ b/crates/neon-runtime/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "neon-runtime" -version = "0.10.0" +version = "0.10.1" authors = ["Dave Herman "] description = "Bindings to the Node.js native addon API, used by the Neon implementation." repository = "https://github.com/neon-bindings/neon" @@ -10,7 +10,7 @@ edition = "2018" [dependencies] cfg-if = "1.0.0" libloading = { version = "0.6.5", optional = true } -neon-sys = { version = "=0.10.0", path = "../neon-sys", optional = true } +neon-sys = { version = "=0.10.1", path = "../neon-sys", optional = true } smallvec = "1.4.2" [dev-dependencies] diff --git a/crates/neon-sys/Cargo.toml b/crates/neon-sys/Cargo.toml index a404e423b..3ea97cfe0 100644 --- a/crates/neon-sys/Cargo.toml +++ b/crates/neon-sys/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "neon-sys" -version = "0.10.0" +version = "0.10.1" authors = ["David Herman "] description = "Exposes the low-level V8/NAN C/C++ APIs. Will be superseded by N-API." edition = "2018" diff --git a/package-lock.json b/package-lock.json index 3a82ef6a2..fc36da9e5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -17,7 +17,7 @@ }, "cli": { "name": "neon-cli", - "version": "0.10.0", + "version": "0.10.1", "license": "SEE LICENSE IN LICENSE-*", "dependencies": { "chalk": "^4.1.0", diff --git a/src/types/buffer/types.rs b/src/types/buffer/types.rs index a3239d771..b94eeacbb 100644 --- a/src/types/buffer/types.rs +++ b/src/types/buffer/types.rs @@ -43,7 +43,7 @@ impl JsBuffer { pub fn external<'a, C, T>(cx: &mut C, data: T) -> Handle<'a, Self> where C: Context<'a>, - T: AsMut<[u8]> + Send, + T: AsMut<[u8]> + Send + 'static, { let env = cx.env().to_raw(); let value = unsafe { neon_runtime::buffer::new_external(env, data) }; @@ -151,7 +151,7 @@ impl JsArrayBuffer { pub fn external<'a, C, T>(cx: &mut C, data: T) -> Handle<'a, Self> where C: Context<'a>, - T: AsMut<[u8]> + Send, + T: AsMut<[u8]> + Send + 'static, { let env = cx.env().to_raw(); let value = unsafe { neon_runtime::arraybuffer::new_external(env, data) };