Home Original page

Fix various overflows and UB in src/ by indutny · Pull Request #7494 · nodejs/node

added 3 commits

June 30, 2016 03:41
`offset` is user supplied variable and may be bigger than
`ts_obj_length`. There is no need to subtract them and pass along, so
just throw when the subtraction result would overflow.
Many extensions are unknown to the `ClientHelloParser::ParseExtension`,
do not cast user-supplied `uint16_t` to `enum`.
Before values are subtracted in C/C++ they are cast to a common type
which depends on the types of lhs and rhs. Usually this means casting to
a bigger type, and if the sizes are the same - casting to unsigned.

@nodejs-github-bot nodejs-github-bot added the c++

Issues and PRs that require attention from people who are familiar with C++.

label

Jun 30, 2016

@mscdex mscdex added the lib / src

Issues and PRs related to general changes in the lib or src directory.

label

Jun 30, 2016

@mscdex mscdex added the semver-minor

PRs that contain new features and should be released in the next minor version.

label

Jul 1, 2016

indutny added a commit that referenced this pull request

Jul 11, 2016 
`offset` is user supplied variable and may be bigger than
`ts_obj_length`. There is no need to subtract them and pass along, so
just throw when the subtraction result would overflow.

PR-URL: #7494
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

indutny added a commit that referenced this pull request

Jul 11, 2016 
Many extensions are unknown to the `ClientHelloParser::ParseExtension`,
do not cast user-supplied `uint16_t` to `enum`.

PR-URL: #7494
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

cjihrig pushed a commit that referenced this pull request

Aug 10, 2016 
`offset` is user supplied variable and may be bigger than
`ts_obj_length`. There is no need to subtract them and pass along, so
just throw when the subtraction result would overflow.

PR-URL: #7494
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

cjihrig pushed a commit that referenced this pull request

Aug 10, 2016 
Many extensions are unknown to the `ClientHelloParser::ParseExtension`,
do not cast user-supplied `uint16_t` to `enum`.

PR-URL: #7494
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>