mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
Christian Aurich Zanettini Martins
a4f6d7587b
`session.close()` and `session.destroy()` only checked that `options.code` was a bigint or a number. Numbers were then converted to `uint64_t` unchecked, so fractions were truncated and negative, non-finite or too large values were undefined behavior. Bigints were only checked to fit in 64 bits, but QUIC error codes are variable-length integers limited to 62 bits, so larger codes cannot be encoded in the `CONNECTION_CLOSE` frame. Reject codes that are not integers between `0` and `2n ** 62n - 1n`, the range `QuicError` already enforces, before any close or destroy side effects. Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com> PR-URL: https://github.com/nodejs/node/pull/66302 Reviewed-By: Tim Perry <pimterry@gmail.com>