inspector: prevent integer overflow in open()

PR-URL: https://github.com/nodejs/node/pull/44367
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/lib/inspector.js b/lib/inspector.js
index 46779a0ec21..dafc4ef4932 100644
--- a/lib/inspector.js
+++ b/lib/inspector.js
@@ -26,6 +26,8 @@ const EventEmitter = require('events');
 const { queueMicrotask } = require('internal/process/task_queues');
 const {
   validateCallback,
+  isUint32,
+  validateInt32,
   validateObject,
   validateString,
 } = require('internal/validators');
@@ -167,6 +169,13 @@ function inspectorOpen(port, host, wait) {
   if (isEnabled()) {
     throw new ERR_INSPECTOR_ALREADY_ACTIVATED();
   }
+  // inspectorOpen() currently does not typecheck its arguments and adding
+  // such checks would be a potentially breaking change. However, the native
+  // open() function requires the port to fit into a 16-bit unsigned integer,
+  // causing an integer overflow otherwise, so we at least need to prevent that.
+  if (isUint32(port)) {
+    validateInt32(port, 'port', 0, 65535);
+  }
   open(port, host);
   if (wait)
     waitForDebugger();