BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity

src: avoid OOB read in URL parser

Browse Source 
This is not a big concern, because right now, all (non-test) inputs
to the parser are `'\0'`-terminated, but we should be future-proof
here and not perform these OOB reads.

PR-URL: https://github.com/nodejs/node/pull/33640
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
This commit is contained in:
Anna Henningsen authored and James M Snell committed 2020-05-30 10:26:24 -07:00
1 parent c45f881b92
commit 3f32126fd5
2 files changed
+23 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/node_url.cc
+3 -3
View File
@@ -1488,7 +1488,7 @@ void URL::Parse(const char* input,
state = kSpecialRelativeOrAuthority;
} else if (special) {
state = kSpecialAuthoritySlashes;
} else if (p[1] == '/') {
} else if (p + 1 < end && p[1] == '/') {
state = kPathOrAuthority;
p++;
} else {
@@ -1548,7 +1548,7 @@ void URL::Parse(const char* input,
}
break;
case kSpecialRelativeOrAuthority:
if (ch == '/' && p[1] == '/') {
if (ch == '/' && p + 1 < end && p[1] == '/') {
state = kSpecialAuthorityIgnoreSlashes;
p++;
} else {
@@ -1696,7 +1696,7 @@ void URL::Parse(const char* input,
break;
case kSpecialAuthoritySlashes:
state = kSpecialAuthorityIgnoreSlashes;
if (ch == '/' && p[1] == '/') {
if (ch == '/' && p + 1 < end && p[1] == '/') {
p++;
} else {
continue;
test/cctest/test_url.cc
+20
View File
@@ -81,6 +81,26 @@ TEST_F(URLTest, Base3) {
EXPECT_EQ(simple.path(), "/baz");
}
TEST_F(URLTest, TruncatedAfterProtocol) {
char input[2] = { 'q', ':' };
URL simple(input, sizeof(input));
EXPECT_FALSE(simple.flags() & URL_FLAGS_FAILED);
EXPECT_EQ(simple.protocol(), "q:");
EXPECT_EQ(simple.host(), "");
EXPECT_EQ(simple.path(), "/");
}
TEST_F(URLTest, TruncatedAfterProtocol2) {
char input[6] = { 'h', 't', 't', 'p', ':', '/' };
URL simple(input, sizeof(input));
EXPECT_TRUE(simple.flags() & URL_FLAGS_FAILED);
EXPECT_EQ(simple.protocol(), "http:");
EXPECT_EQ(simple.host(), "");
EXPECT_EQ(simple.path(), "");
}
TEST_F(URLTest, ToFilePath) {
#define T(url, path) EXPECT_EQ(path, URL(url).ToFilePath())
T("http://example.org/foo/bar", "");