Commit e2faa3a
committed
src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR
This function call can fail with `Z_VERSION_ERROR` if the compiled
library vs loaded library mismatched in version number or in
stream structure size.
In those cases, zlib doesn't initialize the `strm_.msg` field to
null. Therefore, when a `CompressionError` object is created via
`ErrorForMessage()`, it can read a stale or uninitialized `strm_.msg`
pointer that will cause a crash.
Example ASAN report:
```
==291205==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7222adf1a7dd bp 0x7fff2de70650 sp 0x7fff2de6fe08 T0)
==291205==The signal is caused by a READ memory access.
==291205==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x7222adf1a7dd in __strlen_avx2 string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1 0x5bf61d442ab7 in strlen (/work/node/out/Debug/node+0x1a42ab7) (BuildId: 54c4d388769aa50da2f368749b0abbbb804e86a9)
#2 0x5bf61e2d18c4 in v8::(anonymous namespace)::StringLength(char const*) /work/node/out/../deps/v8/src/api/api.cc:7581:16
#3 0x5bf61e2d18c4 in v8::(anonymous namespace)::StringLength(unsigned char const*) /work/node/out/../deps/v8/src/api/api.cc:7587:10
#4 0x5bf61e2d18c4 in v8::String::NewFromOneByte(v8::Isolate*, unsigned char const*, v8::NewStringType, int) /work/node/out/../deps/v8/src/api/api.cc:7677:3
#5 0x5bf61d5499b8 in node::OneByteString(v8::Isolate*, char const*, int, v8::NewStringType) /work/node/out/../src/util-inl.h:166:10
#6 0x5bf61de71213 in node::(anonymous namespace)::CompressionStream<node::(anonymous namespace)::ZlibContext>::EmitError(node::(anonymous namespace)::CompressionError const&) /work/node/out/../src/node_zlib.cc:565:7
#7 0x5bf61de70be6 in node::(anonymous namespace)::CompressionStream<node::(anonymous namespace)::ZlibContext>::CheckError() /work/node/out/../src/node_zlib.cc:519:5
#8 0x5bf61de6d9c0 in node::(anonymous namespace)::CompressionStream<node::(anonymous namespace)::ZlibContext>::AfterThreadPoolWork(int) /work/node/out/../src/node_zlib.cc:543:10
#9 0x5bf61d8729be in node::ThreadPoolWork::ScheduleWork()::'lambda'(uv_work_s*, int)::operator()(uv_work_s*, int) const /work/node/out/../src/threadpoolwork-inl.h:57:15
#10 0x5bf61d87242c in node::ThreadPoolWork::ScheduleWork()::'lambda'(uv_work_s*, int)::__invoke(uv_work_s*, int) /work/node/out/../src/threadpoolwork-inl.h:48:7
#11 0x7222aea8bfef in uv__work_done /work/libuv-1.51.0/src/threadpool.c:330:5
#12 0x7222aea900e2 in uv__async_io.part.0 /work/libuv-1.51.0/src/unix/async.c:208:5
```
Signed-off-by: ndossche <nora.dossche@ugent.be>1 parent 5c87012 commit e2faa3a
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1165 | 1165 | | |
1166 | 1166 | | |
1167 | 1167 | | |
1168 | | - | |
| 1168 | + | |
1169 | 1169 | | |
1170 | 1170 | | |
1171 | 1171 | | |
| |||
0 commit comments