1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

buffer: fix copy() segfault with zero arguments

Browse Source 
Buffer#copy() immediately does a ToObject() on the first argument before
it checks if it's even an Object. This causes
Object::HasIndexedPropertiesInExternalArrayData() to be run on nothing,
triggering the segfault. Instead run HasInstance() on the args Value.
Which will check if it's actually an Object, before checking if it
contains data.

Fixes: https://github.com/iojs/io.js/issues/1519
PR-URL: https://github.com/iojs/io.js/pull/1520
Reviewed-by: Evan Lucas <evanlucas@me.com>
This commit is contained in:
Trevor Norris 2015-04-24 10:50:15 -06:00
parent 2f6986ee46
commit 5404cbc745
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/node_buffer.cc
View File

@ -303,11 +303,11 @@ void Base64Slice(const FunctionCallbackInfo<Value>& args) {
void Copy(const FunctionCallbackInfo<Value> &args) { void Copy(const FunctionCallbackInfo<Value> &args) {
Environment* env = Environment::GetCurrent(args); Environment* env = Environment::GetCurrent(args);
Local<Object> target = args[0]->ToObject(env->isolate()); if (!HasInstance(args[0]))
if (!HasInstance(target))
return env->ThrowTypeError("first arg should be a Buffer"); return env->ThrowTypeError("first arg should be a Buffer");
Local<Object> target = args[0]->ToObject(env->isolate());
ARGS_THIS(args.This()) ARGS_THIS(args.This())
size_t target_length = target->GetIndexedPropertiesExternalArrayDataLength(); size_t target_length = target->GetIndexedPropertiesExternalArrayDataLength();
char* target_data = static_cast<char*>( char* target_data = static_cast<char*>(

5
test/parallel/test-buffer.js
View File

@ -1179,3 +1179,8 @@ var ps = Buffer.poolSize;
Buffer.poolSize = 0; Buffer.poolSize = 0;
assert.equal(Buffer(1).parent, undefined); assert.equal(Buffer(1).parent, undefined);
Buffer.poolSize = ps; Buffer.poolSize = ps;
// Test Buffer.copy() segfault
assert.throws(function() {
Buffer(10).copy();
});