nodejs / node

Node.js JavaScript runtime ✨🐢🚀✨
https://nodejs.org
Other
107.44k stars 29.54k forks source link

Crash if wrong hex string is written to http.ClientRequest #45150

Open Flarna opened 2 years ago

Flarna commented 2 years ago

Version

19.0.0 (but happens also on older versions, last retest with 21.4.0)

Platform

all

Subsystem

http, maybe streams

What steps will reproduce the bug?

if an invalid hex encoded string is written to a http.ClientRequest node crashes/asserts.

const http = require("http");

const request = http.request("http://example.org", {method: "POST"});
request.write("1", "hex");

How often does it reproduce? Is there a required condition?

always

What is the expected behavior?

More graceful error handling like a JS exception.

What do you see instead?

assert/crash

node[360]: ../src/string_bytes.cc:420:static v8::Maybe<long unsigned int> node::StringBytes::StorageSize(v8::Isolate*, v8::Local<v8::Value>, node::encoding): Assertion `str->Length() % 2 == 0 && "invalid hex string length"' failed.
 1: 0xbbf330 node::Abort() [node]
 2: 0xbbf3ae  [node]
 3: 0xcaf8ba node::StringBytes::StorageSize(v8::Isolate*, v8::Local<v8::Value>, node::encoding) [node]
 4: 0xca562a node::StreamBase::Writev(v8::FunctionCallbackInfo<v8::Value> const&) [node]
 5: 0xca7876 void node::StreamBase::JSMethod<&node::StreamBase::Writev>(v8::FunctionCallbackInfo<v8::Value> const&) [node]
 6: 0xe03f00  [node]
 7: 0xe05356 v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
 8: 0x17fb3f9  [node]
Aborted (core dumped)

Additional information

This seems to be not limited to http, net shows same problem with following code:

const net = require("node:net");
const s = net.createConnection(8000);
s.on("connect", () => {
    s.cork()
    s.write("a")
    s.write("1", "hex");
    s.uncork()
});

Interesting is that following net sample doesn't crash:

const net = require("node:net");
const s = net.createConnection(8000);
s.on("connect", () => {
    s.write("1", "hex");
});

Seems in this case the single, invalid hex encoded byte is silently discarded.

juanarbol commented 2 years ago

I could work on this one :)