string_decoder: fix crash when calling __proto__.write()

This makes the function throw an exception from JS instead of crashing. Fixes: #41949 Signed-off-by: Darshan Sen <[email protected]> PR-URL: #42062 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Mestery <[email protected]>
nodejs · Mar 20, 2022 · 3492a0e · 3492a0e
1 parent b89f4d5
commit 3492a0e
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/lib/string_decoder.js b/lib/string_decoder.js
@@ -43,6 +43,7 @@ const {
 const internalUtil = require('internal/util');
 const {
   ERR_INVALID_ARG_TYPE,
+  ERR_INVALID_THIS,
   ERR_UNKNOWN_ENCODING
 } = require('internal/errors').codes;
 const isEncoding = Buffer[internalUtil.kIsEncodingSymbol];
@@ -101,6 +102,9 @@ StringDecoder.prototype.write = function write(buf) {
     throw new ERR_INVALID_ARG_TYPE('buf',
                                    ['Buffer', 'TypedArray', 'DataView'],
                                    buf);
+  if (!this[kNativeDecoder]) {
+    throw new ERR_INVALID_THIS('StringDecoder');
+  }
   return decode(this[kNativeDecoder], buf);
 };
 

diff --git a/test/parallel/test-string-decoder.js b/test/parallel/test-string-decoder.js
@@ -210,6 +210,13 @@ if (common.enoughTestMem) {
   );
 }
 
+assert.throws(
+  () => new StringDecoder('utf8').__proto__.write(Buffer.from('abc')), // eslint-disable-line no-proto
+  {
+    code: 'ERR_INVALID_THIS',
+  }
+);
+
 // Test verifies that StringDecoder will correctly decode the given input
 // buffer with the given encoding to the expected output. It will attempt all
 // possible ways to write() the input buffer, see writeSequences(). The