Closed
Description
We found two type confusion bugs in process_wrap.cc.
First one uses ToObject unchecked: https://github.com/nodejs/node/blob/master/src/process_wrap.cc#L136
Second one uses As unchecked: https://github.com/nodejs/node/blob/master/src/process_wrap.cc#L92
The two programs below that trigger these bugs. We’re using process.binding here, but we’ve been pretty successful at escalating such things to public API.
— trigger 1:
P=process.binding('process_wrap').Process; new P().spawn();— trigger 2:
const options = {file:'ls'};
Object.defineProperty(options, 'stdio', {
get: () => {
return [1];
},
enumerable: true
});
P=process.binding('process_wrap').Process; new P().spawn(options);