Skip to content

Commit ea7aaf3

Browse files
ronagramidzkh
authored andcommitted
v8: out of bounds copy
Fixes: #54573 Co-authored-by: ronag <ronagy@icloud.com> Co-authored-by: ramidzkh <ramidzkh@gmail.com> PR-URL: #55261 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
1 parent 800f7c4 commit ea7aaf3

File tree

2 files changed

+5
-2
lines changed

2 files changed

+5
-2
lines changed

lib/v8.js

+1-2
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@ if (internalBinding('config').hasInspector) {
4949
}
5050

5151
const assert = require('internal/assert');
52-
const { copy } = internalBinding('buffer');
5352
const { inspect } = require('internal/util/inspect');
5453
const { FastBuffer } = require('internal/buffer');
5554
const { getValidatedPath } = require('internal/fs/utils');
@@ -368,7 +367,7 @@ class DefaultDeserializer extends Deserializer {
368367
}
369368
// Copy to an aligned buffer first.
370369
const buffer_copy = Buffer.allocUnsafe(byteLength);
371-
copy(this.buffer, buffer_copy, 0, byteOffset, byteOffset + byteLength);
370+
buffer_copy.set(new Uint8Array(this.buffer.buffer, this.buffer.byteOffset + byteOffset, byteLength));
372371
return new ctor(buffer_copy.buffer,
373372
buffer_copy.byteOffset,
374373
byteLength / BYTES_PER_ELEMENT);

test/parallel/test-v8-deserialize-buffer.js

+4
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,7 @@ const v8 = require('v8');
55

66
process.on('warning', common.mustNotCall());
77
v8.deserialize(v8.serialize(Buffer.alloc(0)));
8+
v8.deserialize(v8.serialize({ a: new Int32Array(1024) }));
9+
v8.deserialize(v8.serialize({ b: new Int16Array(8192) }));
10+
v8.deserialize(v8.serialize({ c: new Uint32Array(1024) }));
11+
v8.deserialize(v8.serialize({ d: new Uint16Array(8192) }));

0 commit comments

Comments
 (0)