Permalink
Browse files

src: fix buffer overflow for long exception lines

Long exception lines resulted in a stack buffer overflow or assertion
because it was assumed snprintf not counts discarded chars
or the assertion itself was incorrect: `(off) >= sizeof(arrow)`

PR-URL: #2404
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
  • Loading branch information...
skomski authored and rvagg committed Sep 3, 2015
1 parent 7038388 commit cddbec231f86774bbbb78fb271894a8fcf4e8dc1
Showing with 19 additions and 12 deletions.
  1. +13 −11 src/node.cc
  2. +1 −0 test/fixtures/throws_error5.js
  3. +5 −1 test/parallel/test-error-reporting.js
View
@@ -1288,8 +1288,6 @@ void AppendExceptionLine(Environment* env,
err_obj->SetHiddenValue(env->processed_string(), True(env->isolate()));
}
char arrow[1024];
// Print (filename):(line number): (message).
node::Utf8Value filename(env->isolate(), message->GetScriptResourceName());
const char* filename_string = *filename;
@@ -1322,34 +1320,38 @@ void AppendExceptionLine(Environment* env,
int start = message->GetStartColumn();
int end = message->GetEndColumn();
char arrow[1024];
int max_off = sizeof(arrow) - 2;
int off = snprintf(arrow,
sizeof(arrow),
"%s:%i\n%s\n",
filename_string,
linenum,
sourceline_string);
CHECK_GE(off, 0);
if (off > max_off) {
off = max_off;
}
// Print wavy underline (GetUnderline is deprecated).
for (int i = 0; i < start; i++) {
if (sourceline_string[i] == '\0' ||
static_cast<size_t>(off) >= sizeof(arrow)) {
if (sourceline_string[i] == '\0' || off >= max_off) {
break;
}
CHECK_LT(static_cast<size_t>(off), sizeof(arrow));
CHECK_LT(off, max_off);
arrow[off++] = (sourceline_string[i] == '\t') ? '\t' : ' ';
}
for (int i = start; i < end; i++) {
if (sourceline_string[i] == '\0' ||
static_cast<size_t>(off) >= sizeof(arrow)) {
if (sourceline_string[i] == '\0' || off >= max_off) {
break;
}
CHECK_LT(static_cast<size_t>(off), sizeof(arrow));
CHECK_LT(off, max_off);
arrow[off++] = '^';
}
CHECK_LE(static_cast<size_t>(off - 1), sizeof(arrow) - 1);
arrow[off++] = '\n';
arrow[off] = '\0';
CHECK_LE(off, max_off);
arrow[off] = '\n';
arrow[off + 1] = '\0';
Local<String> arrow_str = String::NewFromUtf8(env->isolate(), arrow);
Local<Value> msg;

Some generated files are not rendered by default. Learn more.

Oops, something went wrong.
@@ -54,7 +54,11 @@ errExec('throws_error4.js', function(err, stdout, stderr) {
assert.ok(/SyntaxError/.test(stderr));
});
// Long exception line doesn't result in stack overflow
errExec('throws_error5.js', function(err, stdout, stderr) {
assert.ok(/SyntaxError/.test(stderr));
});
process.on('exit', function() {
assert.equal(4, exits);
assert.equal(5, exits);
});

0 comments on commit cddbec2

Please sign in to comment.