Skip to content

Commit

Permalink
dgram: fix send with out of bounds offset + length
Browse files Browse the repository at this point in the history
fix Socket.prototype.send sending garbage when the message is a string,
or Buffer and offset+length is out of bounds.

Fixes: nodejs#40491
  • Loading branch information
Linkgoron committed Oct 22, 2021
1 parent 89c0577 commit 63a0887
Show file tree
Hide file tree
Showing 2 changed files with 78 additions and 0 deletions.
13 changes: 13 additions & 0 deletions lib/dgram.js
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ const { guessHandleType } = internalBinding('util');
const {
ERR_INVALID_ARG_TYPE,
ERR_MISSING_ARGS,
ERR_OUT_OF_RANGE,
ERR_SOCKET_ALREADY_BOUND,
ERR_SOCKET_BAD_BUFFER_SIZE,
ERR_SOCKET_BUFFER_SIZE,
Expand Down Expand Up @@ -488,6 +489,18 @@ function sliceBuffer(buffer, offset, length) {
offset = offset >>> 0;
length = length >>> 0;

// TypedArray and DataView bounds are checked in Buffer.from
if (Buffer.isBuffer(buffer)) {
if (offset > buffer.byteLength) {
throw new ERR_OUT_OF_RANGE('offset', `<= ${buffer.byteLength}`, offset);
}

if (offset + length > buffer.byteLength) {
throw new ERR_OUT_OF_RANGE('length',
`<= ${buffer.byteLength - offset}`, length);
}
}

return Buffer.from(buffer.buffer, buffer.byteOffset + offset, length);
}

Expand Down
65 changes: 65 additions & 0 deletions test/parallel/test-dgram-send-bad-arguments.js
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,71 @@ function checkArgs(connected) {
message: 'Already connected'
}
);

for (const input of ['hello', Buffer.from('hello'),
Buffer.from('hello world').subarray(0, 5),
Buffer.from('hello world').subarray(6)]) {
assert.throws(
() => { sock.send(input, 6, 0); },
{
code: 'ERR_OUT_OF_RANGE',
name: 'RangeError',
message: 'The value of "offset" is out of range. ' +
'It must be <= 5. Received 6'
}
);

assert.throws(
() => { sock.send(input, 0, 6); },
{
code: 'ERR_OUT_OF_RANGE',
name: 'RangeError',
message: 'The value of "length" is out of range. ' +
'It must be <= 5. Received 6'
}
);

assert.throws(
() => { sock.send(input, 3, 4); },
{
code: 'ERR_OUT_OF_RANGE',
name: 'RangeError',
message: 'The value of "length" is out of range. ' +
'It must be <= 2. Received 4'
}
);
}

for (const input of [new Uint8Array([1, 2, 3, 4, 5]),
new DataView(new ArrayBuffer(5), 0),
new DataView(new ArrayBuffer(6), 2)]) {
assert.throws(
() => { sock.send(input, 6, 0); },
{
code: 'ERR_BUFFER_OUT_OF_BOUNDS',
name: 'RangeError',
message: '"offset" is outside of buffer bounds',
}
);

assert.throws(
() => { sock.send(input, 0, 6); },
{
code: 'ERR_BUFFER_OUT_OF_BOUNDS',
name: 'RangeError',
message: '"length" is outside of buffer bounds',
}
);

assert.throws(
() => { sock.send(input, 3, 4); },
{
code: 'ERR_BUFFER_OUT_OF_BOUNDS',
name: 'RangeError',
message: '"length" is outside of buffer bounds',
}
);
}
} else {
assert.throws(() => { sock.send(buf, 1, 1, -1, host); }, RangeError);
assert.throws(() => { sock.send(buf, 1, 1, 0, host); }, RangeError);
Expand Down

0 comments on commit 63a0887

Please sign in to comment.