Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

src: fix array overrun in node::url::SetArgs() #46541

Closed
wants to merge 1 commit into from

Conversation

tniessen
Copy link
Member

@tniessen tniessen commented Feb 7, 2023

Refs: #46410

@tniessen tniessen added whatwg-url Issues and PRs related to the WHATWG URL implementation. fast-track PRs that do not need to wait for 48 hours to land. labels Feb 7, 2023
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Feb 7, 2023
@github-actions
Copy link
Contributor

github-actions bot commented Feb 7, 2023

Fast-track has been requested by @tniessen. Please 👍 to approve.

@tniessen tniessen added the request-ci Add this label to start a Jenkins CI on a PR. label Feb 7, 2023
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 7, 2023
@nodejs-github-bot
Copy link
Collaborator

@@ -47,7 +47,7 @@ enum url_update_action {
kHref = 9,
};

void SetArgs(Environment* env, Local<Value> argv[12], const ada::result& url) {
void SetArgs(Environment* env, Local<Value> argv[13], const ada::result& url) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Array arguments decay to pointers so this, in the abstract, doesn't fix anything. You could change it to:

Suggested change
void SetArgs(Environment* env, Local<Value> argv[13], const ada::result& url) {
void SetArgs(Environment* env, Local<Value> (*argv)[13], const ada::result& url) {

That forces callers to pass a 13-element array by address, i.e.:

Local<Value> argv[13];
SetArgs(env, &argv, url);

You'll need to update all the assignments from argv[0] to (*argv)[0].

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For education purposes: How did the code work before this change?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It wrote past the end. Array arguments aren't length-checked; to the compiler int x[42] equals int x[] equals int *x.

@anonrig
Copy link
Member

anonrig commented Feb 7, 2023

cc @nodejs/url

@panva panva removed the fast-track PRs that do not need to wait for 48 hours to land. label Feb 23, 2023
@tniessen
Copy link
Member Author

tniessen commented Mar 2, 2023

Seems like #46736 implicitly overwrote this.

@tniessen tniessen closed this Mar 2, 2023
@TimothyGu
Copy link
Member

I believe @bnoordhuis's comment above is still relevant though. @anonrig is there any chance you could pick it up in a future PR?

@anonrig
Copy link
Member

anonrig commented Mar 7, 2023

I believe @bnoordhuis's comment above is still relevant though. @anonrig is there any chance you could pick it up in a future PR?

I agree. I'll open a PR. Thanks for the mention.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. whatwg-url Issues and PRs related to the WHATWG URL implementation.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants