Skip to content

Commit 79573f4

Browse files
committed
buffer: validate UTF8 on fast path
Fast API handles invalid UTF differently than the slow API. Fixes: #54521 PR-URL: #54525
1 parent d5dc540 commit 79573f4

File tree

3 files changed

+57
-1
lines changed

3 files changed

+57
-1
lines changed

src/node_buffer.cc

+32-1
Original file line numberDiff line numberDiff line change
@@ -1489,6 +1489,35 @@ uint32_t FastWriteString(Local<Value> receiver,
14891489

14901490
static v8::CFunction fast_write_string(v8::CFunction::Make(FastWriteString));
14911491

1492+
uint32_t FastWriteStringUTF8(
1493+
Local<Value> receiver,
1494+
const v8::FastApiTypedArray<uint8_t>& dst,
1495+
const v8::FastOneByteString& src,
1496+
uint32_t offset,
1497+
uint32_t max_length,
1498+
// NOLINTNEXTLINE(runtime/references) This is V8 api.
1499+
v8::FastApiCallbackOptions& options) {
1500+
uint8_t* dst_data;
1501+
CHECK(dst.getStorageIfAligned(&dst_data));
1502+
CHECK(offset <= dst.length());
1503+
CHECK(dst.length() - offset <= std::numeric_limits<uint32_t>::max());
1504+
1505+
const auto size = std::min(
1506+
{static_cast<uint32_t>(dst.length() - offset), max_length, src.length});
1507+
1508+
if (!simdutf::validate_utf8(src.data, size)) {
1509+
options.fallback = true;
1510+
return 0;
1511+
}
1512+
1513+
memcpy(dst_data + offset, src.data, size);
1514+
1515+
return size;
1516+
}
1517+
1518+
static v8::CFunction fast_write_string_utf8(
1519+
v8::CFunction::Make(FastWriteStringUTF8));
1520+
14921521
void Initialize(Local<Object> target,
14931522
Local<Value> unused,
14941523
Local<Context> context,
@@ -1568,7 +1597,7 @@ void Initialize(Local<Object> target,
15681597
target,
15691598
"utf8WriteStatic",
15701599
SlowWriteString<UTF8>,
1571-
&fast_write_string);
1600+
&fast_write_string_utf8);
15721601

15731602
SetMethod(context, target, "getZeroFillToggle", GetZeroFillToggle);
15741603
}
@@ -1615,6 +1644,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
16151644
registry->Register(SlowWriteString<UTF8>);
16161645
registry->Register(fast_write_string.GetTypeInfo());
16171646
registry->Register(FastWriteString);
1647+
registry->Register(fast_write_string_utf8.GetTypeInfo());
1648+
registry->Register(FastWriteStringUTF8);
16181649
registry->Register(StringWrite<ASCII>);
16191650
registry->Register(StringWrite<BASE64>);
16201651
registry->Register(StringWrite<BASE64URL>);

src/node_external_reference.h

+11
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ using CFunctionCallbackWithTwoUint8ArraysFallback =
4040
bool (*)(v8::Local<v8::Value>,
4141
const v8::FastApiTypedArray<uint8_t>&,
4242
const v8::FastApiTypedArray<uint8_t>&,
43+
// NOLINTNEXTLINE(runtime/references) This is V8 api.
4344
v8::FastApiCallbackOptions&);
4445
using CFunctionCallbackWithUint8ArrayUint32Int64Bool =
4546
int32_t (*)(v8::Local<v8::Value>,
@@ -63,6 +64,15 @@ using CFunctionWriteString =
6364
uint32_t offset,
6465
uint32_t max_length);
6566

67+
using CFunctionWriteStringFallback =
68+
uint32_t (*)(v8::Local<v8::Value> receiver,
69+
const v8::FastApiTypedArray<uint8_t>& dst,
70+
const v8::FastOneByteString& src,
71+
uint32_t offset,
72+
uint32_t max_length,
73+
// NOLINTNEXTLINE(runtime/references) This is V8 api.
74+
v8::FastApiCallbackOptions& options);
75+
6676
using CFunctionBufferCopy =
6777
uint32_t (*)(v8::Local<v8::Value> receiver,
6878
const v8::FastApiTypedArray<uint8_t>& source,
@@ -96,6 +106,7 @@ class ExternalReferenceRegistry {
96106
V(CFunctionWithBool) \
97107
V(CFunctionBufferCopy) \
98108
V(CFunctionWriteString) \
109+
V(CFunctionWriteStringFallback) \
99110
V(const v8::CFunctionInfo*) \
100111
V(v8::FunctionCallback) \
101112
V(v8::AccessorNameGetterCallback) \

test/parallel/test-buffer-write.js

+14
Original file line numberDiff line numberDiff line change
@@ -106,3 +106,17 @@ assert.strictEqual(Buffer.alloc(4)
106106
assert.strictEqual(buf.write('ыы', 1, 'utf16le'), 4);
107107
assert.deepStrictEqual([...buf], [0, 0x4b, 0x04, 0x4b, 0x04, 0, 0, 0]);
108108
}
109+
110+
{
111+
let i = 0;
112+
113+
while (i < 1_000_000) {
114+
const buf = Buffer.from("\x80")
115+
116+
if (buf[0] !== 194 || buf[1] !== 128) {
117+
assert(false);
118+
}
119+
120+
i++;
121+
}
122+
}

0 commit comments

Comments
 (0)