Skip to content

Commit

Permalink
util: fix out of bounds indices in util.inspect
Browse files Browse the repository at this point in the history
This fixes a issue brought up in #15288.

PR-URL: #14881
Refs: #15288
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
  • Loading branch information
BridgeAR authored and jasnell committed Sep 21, 2017
1 parent 9e8b1b3 commit 5b47f84
Show file tree
Hide file tree
Showing 2 changed files with 39 additions and 6 deletions.
22 changes: 16 additions & 6 deletions lib/util.js
Original file line number Diff line number Diff line change
Expand Up @@ -652,6 +652,9 @@ function formatSpecialArray(ctx, value, recurseTimes, keys, maxLength, valLen) {
if (visibleLength === maxLength)
break;
const index = +key;
// Arrays can only have up to 2^32 - 1 entries
if (index > 2 ** 32 - 2)
break;
if (i !== index) {
if (!numberRegExp.test(key))
break;
Expand All @@ -674,6 +677,8 @@ function formatSpecialArray(ctx, value, recurseTimes, keys, maxLength, valLen) {
const message = `<${len} empty item${ending}>`;
output.push(ctx.stylize(message, 'undefined'));
i = valLen;
if (keyLen === 0)
return output;
}
const remaining = valLen - i;
if (remaining > 0) {
Expand All @@ -687,13 +692,18 @@ function formatSpecialArray(ctx, value, recurseTimes, keys, maxLength, valLen) {
// The array is not sparse
for (i = valLen; i < keyLen; i++)
output.push(formatProperty(ctx, value, recurseTimes, keys[i], 2));
} else if (keyLen !== 0 && keys[keyLen - 1] !== `${valLen - 1}`) {
for (const key of keys) {
// Skip regular indices
if (!numberRegExp.test(key)) {
output.push(formatProperty(ctx, value, recurseTimes, key, 2));
}
} else if (keys[keyLen - 1] !== `${valLen - 1}`) {
const extra = [];
// Only handle special keys
var key;
for (i = keys.length - 1; i >= 0; i--) {
key = keys[i];
if (numberRegExp.test(key) && +key < 2 ** 32 - 1)
break;
extra.push(formatProperty(ctx, value, recurseTimes, key, 2));
}
for (i = extra.length - 1; i >= 0; i--)
output.push(extra[i]);
}
return output;
}
Expand Down
23 changes: 23 additions & 0 deletions test/parallel/test-util-inspect.js
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,29 @@ assert.strictEqual(
assert.strictEqual(util.inspect(arr3), "[ '-1': -1 ]");
}

// Indices out of bounds
{
const arr = [];
arr[2 ** 32] = true; // not a valid array index
assert.strictEqual(util.inspect(arr), "[ '4294967296': true ]");
arr[0] = true;
arr[10] = true;
assert.strictEqual(util.inspect(arr),
"[ true, <9 empty items>, true, '4294967296': true ]");
arr[2 ** 32 - 2] = true;
arr[2 ** 32 - 1] = true;
arr[2 ** 32 + 1] = true;
delete arr[0];
delete arr[10];
assert.strictEqual(util.inspect(arr),
['[ <4294967294 empty items>,',
'true,',
"'4294967296': true,",
"'4294967295': true,",
"'4294967297': true ]"
].join('\n '));
}

// Function with properties
{
const value = () => {};
Expand Down

0 comments on commit 5b47f84

Please sign in to comment.