fix: validate native ArrayBuffer sizes - #1642
huytdps13400 wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
| std::shared_ptr<ArrayBuffer> HybridNitroModulesProxy::createNativeArrayBuffer(double size) { | ||
| const double maximumSizeExclusive = std::ldexp(1.0, std::numeric_limits<size_t>::digits); | ||
| if (!std::isfinite(size) || size < 0 || size >= maximumSizeExclusive) [[unlikely]] { | ||
| throw std::invalid_argument("ArrayBuffer size must be finite, non-negative, and within the platform size limit."); | ||
| } | ||
| return ArrayBuffer::allocate(static_cast<size_t>(size)); | ||
| } |
There was a problem hiding this comment.
Why here instead of inside ArrayBuffer::allocate(..) directly? Also not sure if we should even catch this, I mean allocating NaN buffers is honestly a user mistake.
There was a problem hiding this comment.
The check needs to run while the value is still a JavaScript double: ArrayBuffer::allocate currently takes size_t, so moving this check into that existing function would put it after the conversion we need to protect. Converting NaN or an out-of-range double to size_t is undefined behavior; a focused UBSan probe reports nan is outside the range of representable values of type 'unsigned long' at that cast, before allocator entry.
This does not catch allocation failures or silently fix user input. It rejects invalid JS input through the existing exception-to-JS boundary. Valid sizes still use the current size_t allocator API and retain the existing truncation behavior. I would keep this narrow boundary check rather than introduce a floating-point overload that changes overload resolution for native callers. The existing runtime harness regressions in the PR cover NaN, infinity, negative and out-of-range values.
This branch was previously deployed
2 participants
Summary
Breaking changes
None. Valid non-negative sizes keep the existing conversion and allocation behavior. Invalid values now throw deterministically instead of reaching an undefined conversion or allocation attempt.
Verification
AI assistance
Codex using GPT-5.6 Sol assisted with reproduction, implementation, tests, and review.
Fixes #1545