GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — src: fix double free reported by coverity by mhdawson · Pull Request #51046 · nodejs/node

Conversation

@mhdawson

@mhdawson mhdawson commented Dec 4, 2023 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Fix double free reported by coverity. ToBufferEndian() in node_i18n.cc was the only caller of Buffer::New() passing in a MaybeStackBuffer. Coverity reported a double free because there were paths in which the src buffer would be deleted by both the destruction of the MaybeStackBuffer and by the Buffer which was done even in failure cases for Buffer::New().

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bricss reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Dec 4, 2023
@mhdawson

mhdawson commented Dec 4, 2023

Copy link
Copy Markdown
Member Author

There are 3 similar coverity reports to this in node_i18n.cc. This is not new (initial report was in 2022) and should only have affected the error case which is unlikely.

2. Condition U_SUCCESS(*status), taking true branch.
210  if (U_SUCCESS(*status)) {
211    destbuf.SetLength(len);
   	3. freed_arg: ToBufferEndian frees destbuf.buf_. [[hide details](https://scan9.scan.coverity.com/eventId=9536861-3&modelId=9536861-1&fileInstanceId=124810153&filePath=%2Fsrc%2Fnode_i18n.cc&fileStart=107&fileEnd=120)]
212    ret = ToBufferEndian(env, &destbuf);
[/src/node_i18n.cc](https://scan9.scan.coverity.com/fileInstanceId=/124810153&defectInstanceId=/9536861&modelId=/9536861-1)
107MaybeLocal<Object> ToBufferEndian(Environment* env, MaybeStackBuffer<T>* buf) {
   	1. freed_arg: New frees parameter buf->buf_. [[show details](https://scan9.scan.coverity.com/eventId=9536861-4&modelId=9536861-2&fileInstanceId=124809979&filePath=%2Fsrc%2Fnode_internals.h&fileStart=187&fileEnd=205)]
108  MaybeLocal<Object> ret = Buffer::New(env, buf);
109  if (ret.IsEmpty())
110    return ret;
111
112  static_assert(sizeof(T) == 1 || sizeof(T) == 2,
113                "Currently only one- or two-byte buffers are supported");
114  if (sizeof(T) > 1 && IsBigEndian()) {
115    SPREAD_BUFFER_ARG(ret.ToLocalChecked(), retbuf);
116    SwapBytes16(retbuf_data, retbuf_length);
117  }
118
119  return ret;
120}
213  }
   	
CID 275315 (#1 of 1): Double free (USE_AFTER_FREE)
4. double_free: Calling ~MaybeStackBuffer frees pointer destbuf.buf_ which has already been freed. [[show details](https://scan9.scan.coverity.com/eventId=9536861-14&modelId=9536861-5&fileInstanceId=124810940&filePath=%2Fsrc%2Futil.h&fileStart=490&fileEnd=493)]
214  return ret;
215}
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mhdawson
src: fix double free reported by coverity
e9bf31e
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
@mhdawson
mhdawson force-pushed the coverity44 branch from fdb2125 to e9bf31e Compare December 4, 2023 17:39
@mhdawson
squash: address linter complaints
694cf0c
Signed-off-by: Michael Dawson <[email protected]>
@mhdawson mhdawson added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Dec 7, 2023
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Dec 7, 2023
@nodejs-github-bot

nodejs-github-bot commented Dec 7, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/56151/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

jasnell
jasnell approved these changes Dec 9, 2023
View reviewed changes
@nodejs-github-bot

nodejs-github-bot commented Dec 10, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/56195/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

mhdawson added a commit that referenced this pull request Dec 11, 2023
@mhdawson
src: fix double free reported by coverity
9e87091
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #51046
Reviewed-By: James M Snell <[email protected]>
@mhdawson

mhdawson commented Dec 11, 2023

Copy link
Copy Markdown
Member Author

Landed in 9e87091

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mhdawson mhdawson closed this Dec 11, 2023
RafaelGSS pushed a commit that referenced this pull request Dec 15, 2023
@mhdawson @RafaelGSS
src: fix double free reported by coverity
9b7f79a
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #51046
Reviewed-By: James M Snell <[email protected]>
@RafaelGSS RafaelGSS mentioned this pull request Dec 15, 2023
v21.5.0 proposal #51166
Merged
richardlau pushed a commit that referenced this pull request Mar 25, 2024
@mhdawson @richardlau
src: fix double free reported by coverity
c7c9e81
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #51046
Reviewed-By: James M Snell <[email protected]>
@richardlau richardlau mentioned this pull request Mar 25, 2024
v20.12.0 proposal #52212
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@mhdawson @nodejs-github-bot @jasnell
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.