nodejs / uvwasi

WASI syscall API built atop libuv
MIT License
222 stars 48 forks source link

Prevent offset wrapping in `fd_pread` #258

Closed yagehu closed 2 months ago

yagehu commented 3 months ago

This commit inserts a bounds check in fd_pread for the offset parameter. This is necessary because an implicit unsigned-to-signed integer conversion is performed when uv_fs_read is called. Such a conversion results in implementation-defined behavior. One such behavior is the offset wrapping.

fixes #257