diff options
author | JoostK <joost.koehoorn@gmail.com> | 2022-01-09 21:22:30 +0300 |
---|---|---|
committer | Tobias Nießen <tniessen@tnie.de> | 2022-01-14 07:11:56 +0300 |
commit | 79e07a42f90a18c3694e8dc88c98d4b1c7813dfa (patch) | |
tree | becb4db28dd9e48daecd605bc9fcb1d334998ff8 /src/node_messaging.cc | |
parent | df507758e6c35534c78cf8c8398007c20d61d12e (diff) |
src: fix out-of-bounds check of serialization indices
The usage of `CHECK_LE` to verify that the index is within bounds
of a vector's size allows for reading one item past the vector's end,
which is in invalid memory read. This commit fixes the off-by-one error
by changing the bounds check to use `CHECK_LT`.
PR-URL: https://github.com/nodejs/node/pull/41452
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Diffstat (limited to 'src/node_messaging.cc')
-rw-r--r-- | src/node_messaging.cc | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/node_messaging.cc b/src/node_messaging.cc index a1f28d4746d..aac1245f269 100644 --- a/src/node_messaging.cc +++ b/src/node_messaging.cc @@ -98,19 +98,19 @@ class DeserializerDelegate : public ValueDeserializer::Delegate { uint32_t id; if (!deserializer->ReadUint32(&id)) return MaybeLocal<Object>(); - CHECK_LE(id, host_objects_.size()); + CHECK_LT(id, host_objects_.size()); return host_objects_[id]->object(isolate); } MaybeLocal<SharedArrayBuffer> GetSharedArrayBufferFromId( Isolate* isolate, uint32_t clone_id) override { - CHECK_LE(clone_id, shared_array_buffers_.size()); + CHECK_LT(clone_id, shared_array_buffers_.size()); return shared_array_buffers_[clone_id]; } MaybeLocal<WasmModuleObject> GetWasmModuleFromId( Isolate* isolate, uint32_t transfer_id) override { - CHECK_LE(transfer_id, wasm_modules_.size()); + CHECK_LT(transfer_id, wasm_modules_.size()); return WasmModuleObject::FromCompiledModule( isolate, wasm_modules_[transfer_id]); } |