GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||
GeezerVison is showing github.com — src: fix double free reported by coverity by mhdawson · Pull Request #51046 · nodejs/node Conversation
|
|
There are 3 similar coverity reports to this in node_i18n.cc. This is not new (initial report was in 2022) and should only have affected the error case which is unlikely. 2. Condition U_SUCCESS(*status), taking true branch. 210 if (U_SUCCESS(*status)) { 211 destbuf.SetLength(len); 3. freed_arg: ToBufferEndian frees destbuf.buf_. [[hide details](https://scan9.scan.coverity.com/eventId=9536861-3&modelId=9536861-1&fileInstanceId=124810153&filePath=%2Fsrc%2Fnode_i18n.cc&fileStart=107&fileEnd=120)] 212 ret = ToBufferEndian(env, &destbuf); [/src/node_i18n.cc](https://scan9.scan.coverity.com/fileInstanceId=/124810153&defectInstanceId=/9536861&modelId=/9536861-1) 107MaybeLocal<Object> ToBufferEndian(Environment* env, MaybeStackBuffer<T>* buf) { 1. freed_arg: New frees parameter buf->buf_. [[show details](https://scan9.scan.coverity.com/eventId=9536861-4&modelId=9536861-2&fileInstanceId=124809979&filePath=%2Fsrc%2Fnode_internals.h&fileStart=187&fileEnd=205)] 108 MaybeLocal<Object> ret = Buffer::New(env, buf); 109 if (ret.IsEmpty()) 110 return ret; 111 112 static_assert(sizeof(T) == 1 || sizeof(T) == 2, 113 "Currently only one- or two-byte buffers are supported"); 114 if (sizeof(T) > 1 && IsBigEndian()) { 115 SPREAD_BUFFER_ARG(ret.ToLocalChecked(), retbuf); 116 SwapBytes16(retbuf_data, retbuf_length); 117 } 118 119 return ret; 120} 213 } CID 275315 (#1 of 1): Double free (USE_AFTER_FREE) 4. double_free: Calling ~MaybeStackBuffer frees pointer destbuf.buf_ which has already been freed. [[show details](https://scan9.scan.coverity.com/eventId=9536861-14&modelId=9536861-5&fileInstanceId=124810940&filePath=%2Fsrc%2Futil.h&fileStart=490&fileEnd=493)] 214 return ret; 215} |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Fix double free reported by coverity. ToBufferEndian() in node_i18n.cc was the only caller of Buffer::New() passing in a MaybeStackBuffer. Coverity reported a double free because there were paths in which the src buffer would be deleted by both the destruction of the MaybeStackBuffer and by the Buffer which was done even in failure cases for Buffer::New(). Signed-off-by: Michael Dawson <[email protected]>
Signed-off-by: Michael Dawson <[email protected]>
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Fix double free reported by coverity. ToBufferEndian() in node_i18n.cc was the only caller of Buffer::New() passing in a MaybeStackBuffer. Coverity reported a double free because there were paths in which the src buffer would be deleted by both the destruction of the MaybeStackBuffer and by the Buffer which was done even in failure cases for Buffer::New(). Signed-off-by: Michael Dawson <[email protected]> PR-URL: #51046 Reviewed-By: James M Snell <[email protected]>
|
Landed in 9e87091 |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Fix double free reported by coverity. ToBufferEndian() in node_i18n.cc was the only caller of Buffer::New() passing in a MaybeStackBuffer. Coverity reported a double free because there were paths in which the src buffer would be deleted by both the destruction of the MaybeStackBuffer and by the Buffer which was done even in failure cases for Buffer::New(). Signed-off-by: Michael Dawson <[email protected]> PR-URL: #51046 Reviewed-By: James M Snell <[email protected]>
Fix double free reported by coverity. ToBufferEndian() in node_i18n.cc was the only caller of Buffer::New() passing in a MaybeStackBuffer. Coverity reported a double free because there were paths in which the src buffer would be deleted by both the destruction of the MaybeStackBuffer and by the Buffer which was done even in failure cases for Buffer::New(). Signed-off-by: Michael Dawson <[email protected]> PR-URL: #51046 Reviewed-By: James M Snell <[email protected]>
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
There was an error while loading. Please reload this page.