zlib: throw on out-of-bounds write buffers

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#931
Refs: https://hackerone.com/reports/3857258
CVE-ID: CVE-2026-58045

Author: RafaelGSS

src/node_zlib.cc

@@ -518,15 +518,19 @@ class CompressionStream : public AsyncWrap,
       if (!args[2]->Uint32Value(context).To(&in_off)) return;
       if (!args[3]->Uint32Value(context).To(&in_len)) return;
 
-      CHECK(Buffer::IsWithinBounds(in_off, in_len, Buffer::Length(in_buf)));
+      if (!Buffer::IsWithinBounds(in_off, in_len, Buffer::Length(in_buf))) {
+        return THROW_ERR_OUT_OF_RANGE(env, "input buffer is out of bounds");
+      }
       in = Buffer::Data(in_buf) + in_off;
     }
 
     CHECK(Buffer::HasInstance(args[4]));
     Local<Object> out_buf = args[4].As<Object>();
     if (!args[5]->Uint32Value(context).To(&out_off)) return;
     if (!args[6]->Uint32Value(context).To(&out_len)) return;
-    CHECK(Buffer::IsWithinBounds(out_off, out_len, Buffer::Length(out_buf)));
+    if (!Buffer::IsWithinBounds(out_off, out_len, Buffer::Length(out_buf))) {
+      return THROW_ERR_OUT_OF_RANGE(env, "output buffer is out of bounds");
+    }
     out = Buffer::Data(out_buf) + out_off;
 
     CompressionStream* ctx;

test/parallel/test-zlib-invalid-input.js

@@ -52,6 +52,43 @@ nonStringInputs.forEach(common.mustCall((input) => {
   });
 }, nonStringInputs.length));
 
+const spoofedLength = new Uint8Array(1).fill(0x41);
+Object.defineProperty(spoofedLength, 'length', { get: () => 5000 });
+Object.defineProperty(spoofedLength, 'byteLength', { get: () => 5000 });
+
+[
+  zlib.deflateSync,
+  zlib.gzipSync,
+  zlib.deflateRawSync,
+  zlib.unzipSync,
+  zlib.inflateSync,
+  zlib.gunzipSync,
+  zlib.inflateRawSync,
+  zlib.brotliCompressSync,
+  zlib.brotliDecompressSync,
+  zlib.zstdCompressSync,
+  zlib.zstdDecompressSync,
+].forEach((method) => {
+  assert.throws(() => {
+    method(spoofedLength);
+  }, {
+    name: 'RangeError',
+    code: 'ERR_OUT_OF_RANGE',
+  });
+});
+
+{
+  const deflate = zlib.createDeflate();
+  deflate._outOffset = deflate._chunkSize + 1;
+  assert.throws(() => {
+    deflate._processChunk(Buffer.alloc(1), zlib.constants.Z_FINISH);
+  }, {
+    name: 'RangeError',
+    code: 'ERR_OUT_OF_RANGE',
+  });
+  deflate.close();
+}
+
 unzips.forEach(common.mustCall((uz, i) => {
   uz.on('error', common.mustCall());
   uz.on('end', common.mustNotCall());