Skip to content

Commit e2faa3a

Browse files
committed
src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR
This function call can fail with `Z_VERSION_ERROR` if the compiled library vs loaded library mismatched in version number or in stream structure size. In those cases, zlib doesn't initialize the `strm_.msg` field to null. Therefore, when a `CompressionError` object is created via `ErrorForMessage()`, it can read a stale or uninitialized `strm_.msg` pointer that will cause a crash. Example ASAN report: ``` ==291205==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7222adf1a7dd bp 0x7fff2de70650 sp 0x7fff2de6fe08 T0) ==291205==The signal is caused by a READ memory access. ==291205==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. #0 0x7222adf1a7dd in __strlen_avx2 string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76 #1 0x5bf61d442ab7 in strlen (/work/node/out/Debug/node+0x1a42ab7) (BuildId: 54c4d388769aa50da2f368749b0abbbb804e86a9) #2 0x5bf61e2d18c4 in v8::(anonymous namespace)::StringLength(char const*) /work/node/out/../deps/v8/src/api/api.cc:7581:16 #3 0x5bf61e2d18c4 in v8::(anonymous namespace)::StringLength(unsigned char const*) /work/node/out/../deps/v8/src/api/api.cc:7587:10 #4 0x5bf61e2d18c4 in v8::String::NewFromOneByte(v8::Isolate*, unsigned char const*, v8::NewStringType, int) /work/node/out/../deps/v8/src/api/api.cc:7677:3 #5 0x5bf61d5499b8 in node::OneByteString(v8::Isolate*, char const*, int, v8::NewStringType) /work/node/out/../src/util-inl.h:166:10 #6 0x5bf61de71213 in node::(anonymous namespace)::CompressionStream<node::(anonymous namespace)::ZlibContext>::EmitError(node::(anonymous namespace)::CompressionError const&) /work/node/out/../src/node_zlib.cc:565:7 #7 0x5bf61de70be6 in node::(anonymous namespace)::CompressionStream<node::(anonymous namespace)::ZlibContext>::CheckError() /work/node/out/../src/node_zlib.cc:519:5 #8 0x5bf61de6d9c0 in node::(anonymous namespace)::CompressionStream<node::(anonymous namespace)::ZlibContext>::AfterThreadPoolWork(int) /work/node/out/../src/node_zlib.cc:543:10 #9 0x5bf61d8729be in node::ThreadPoolWork::ScheduleWork()::'lambda'(uv_work_s*, int)::operator()(uv_work_s*, int) const /work/node/out/../src/threadpoolwork-inl.h:57:15 #10 0x5bf61d87242c in node::ThreadPoolWork::ScheduleWork()::'lambda'(uv_work_s*, int)::__invoke(uv_work_s*, int) /work/node/out/../src/threadpoolwork-inl.h:48:7 #11 0x7222aea8bfef in uv__work_done /work/libuv-1.51.0/src/threadpool.c:330:5 #12 0x7222aea900e2 in uv__async_io.part.0 /work/libuv-1.51.0/src/unix/async.c:208:5 ``` Signed-off-by: ndossche <nora.dossche@ugent.be>
1 parent 5c87012 commit e2faa3a

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/node_zlib.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1165,7 +1165,7 @@ void ZlibContext::GetAfterWriteOffsets(uint32_t* avail_in,
11651165

11661166

11671167
CompressionError ZlibContext::ErrorForMessage(const char* message) const {
1168-
if (strm_.msg != nullptr)
1168+
if (zlib_init_done_ && strm_.msg != nullptr)
11691169
message = strm_.msg;
11701170

11711171
return CompressionError { message, ZlibStrerror(err_), err_ };

0 commit comments

Comments
 (0)