Skip to content

Commit 2ed3b30

Browse files
tniessenRafaelGSS
authored andcommitted
inspector: prevent integer overflow in open()
PR-URL: #44367 Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>
1 parent c3dbe18 commit 2ed3b30

File tree

3 files changed

+27
-0
lines changed

3 files changed

+27
-0
lines changed

lib/inspector.js

+9
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@ if (!hasInspector)
2525
const EventEmitter = require('events');
2626
const { queueMicrotask } = require('internal/process/task_queues');
2727
const {
28+
isUint32,
2829
validateFunction,
30+
validateInt32,
2931
validateObject,
3032
validateString,
3133
} = require('internal/validators');
@@ -168,6 +170,13 @@ function inspectorOpen(port, host, wait) {
168170
if (isEnabled()) {
169171
throw new ERR_INSPECTOR_ALREADY_ACTIVATED();
170172
}
173+
// inspectorOpen() currently does not typecheck its arguments and adding
174+
// such checks would be a potentially breaking change. However, the native
175+
// open() function requires the port to fit into a 16-bit unsigned integer,
176+
// causing an integer overflow otherwise, so we at least need to prevent that.
177+
if (isUint32(port)) {
178+
validateInt32(port, 'port', 0, 65535);
179+
}
171180
open(port, host);
172181
if (wait)
173182
waitForDebugger();

src/inspector_js_api.cc

+1
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,7 @@ void Open(const FunctionCallbackInfo<Value>& args) {
281281

282282
if (args.Length() > 0 && args[0]->IsUint32()) {
283283
uint32_t port = args[0].As<Uint32>()->Value();
284+
CHECK_LE(port, std::numeric_limits<uint16_t>::max());
284285
ExclusiveAccess<HostPort>::Scoped host_port(agent->host_port());
285286
host_port->set_port(static_cast<int>(port));
286287
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
'use strict';
2+
3+
// Regression test for an integer overflow in inspector.open() when the port
4+
// exceeds the range of an unsigned 16-bit integer.
5+
6+
const common = require('../common');
7+
common.skipIfInspectorDisabled();
8+
common.skipIfWorker();
9+
10+
const assert = require('assert');
11+
const inspector = require('inspector');
12+
13+
assert.throws(() => inspector.open(99999), {
14+
name: 'RangeError',
15+
code: 'ERR_OUT_OF_RANGE',
16+
message: 'The value of "port" is out of range. It must be >= 0 && <= 65535. Received 99999'
17+
});

0 commit comments

Comments
 (0)