Skip to content

Commit

Permalink
src: fix UB in overflow checks
Browse files Browse the repository at this point in the history
Refs: #45868
PR-URL: #45882
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
  • Loading branch information
bnoordhuis authored and juanarbol committed Jan 31, 2023
1 parent 574afac commit e4fc3ab
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions src/process_wrap.cc
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,9 @@
#include "stream_wrap.h"
#include "util-inl.h"

#include <cstring>
#include <climits>
#include <cstdlib>
#include <cstring>

namespace node {

Expand Down Expand Up @@ -190,7 +191,7 @@ class ProcessWrap : public HandleWrap {
if (!argv_v.IsEmpty() && argv_v->IsArray()) {
Local<Array> js_argv = argv_v.As<Array>();
int argc = js_argv->Length();
CHECK_GT(argc + 1, 0); // Check for overflow.
CHECK_LT(argc, INT_MAX); // Check for overflow.

// Heap allocate to detect errors. +1 is for nullptr.
options.args = new char*[argc + 1];
Expand Down Expand Up @@ -218,7 +219,7 @@ class ProcessWrap : public HandleWrap {
if (!env_v.IsEmpty() && env_v->IsArray()) {
Local<Array> env_opt = env_v.As<Array>();
int envc = env_opt->Length();
CHECK_GT(envc + 1, 0); // Check for overflow.
CHECK_LT(envc, INT_MAX); // Check for overflow.
options.env = new char*[envc + 1]; // Heap allocated to detect errors.
for (int i = 0; i < envc; i++) {
node::Utf8Value pair(env->isolate(),
Expand Down

0 comments on commit e4fc3ab

Please sign in to comment.