Crypto issues on Ubuntu 22.04 - Assertion `errors->Empty()' failed

[HiveTechDev]

Version

v16.15.0

Platform

Linux 99eba3b487e3 5.13.0-27-generic #29~20.04.1-Ubuntu SMP Fri Jan 14 00:32:30 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

crypto/crypto_cipher.h:262:v8::Maybe node::crypto::CipherJob::ToResult(v8::Localv8::Value, v8::Localv8::Value)

What steps will reproduce the bug?

Test Script: <some_dir>/test/cryptoTest.js

// Test - See if we can do a basic example with 22.04 and node v16.15.0
// https://stackoverflow.com/questions/25725596/use-window-crypto-in-nodejs-code

const crypto = require('crypto').webcrypto;

var test = async () => {
	let iv = crypto.getRandomValues(new Uint8Array(16));
	let key = crypto.getRandomValues(new Uint8Array(16));
	let data = new Uint8Array(12345);
	//crypto functions are wrapped in promises so we have to use await and make sure the function that
	//contains this code is an async function
	//encrypt function wants a cryptokey object
	data[1] = 1;
	const key_encoded = await crypto.subtle.importKey(  "raw",    key.buffer,   'AES-CTR' ,  false,   ["encrypt", "decrypt"]);

	try{
		await crypto.subtle.encrypt(
			{
				name: "AES-CTR",
				counter: iv,
				length: 128
			},
			key_encoded,
			data
		).then((result) => {
			console.log(result);
		}).catch((err) => {
			console.error(err);
		});
	}
	catch(err){
		console.error(err);
	}
	
	console.log("done.");
}

test();

Steps to setup:

docker run -v $(pwd)/test/:/test/ -ti ubuntu:jammy /bin/bash

# --- in container --- 
apt update
# install node v16.15.0
curl -sL https://deb.nodesource.com/setup_16.x -o /tmp/nodesource_setup.sh
bash /tmp/nodesource_setup.sh
apt install nodejs
node -v
# 16.15.0
node cryptoTest.js
# .... errors ....

How often does it reproduce? Is there a required condition?

Reproducible only on Ubuntu 22.04, confirmed via host OS hard install and in docker for ubuntu 22.04 Jammy

What is the expected behavior?

When run in 20.04 (host OS and docker confirmed)

❯ node cryptoTest.js
ArrayBuffer {
  [Uint8Contents]: <2d ec 99 71 e3 a6 41 2e 4b 65 d4 f8 38 57 f3 4b b5 cb cd e4 ab b9 77 d8 b8 ba aa aa 04 f5 1b e8 3a ec 2e a8 87 a8 c2 90 9a 84 32 af 60 c8 e4 3d eb 36 3f 4f 70 34 10 3a a2 02 08 ac 24 97 c8 d2 51 60 ff a7 3b 1c 26 c3 0f 4f d5 54 50 6e ad fc 84 35 65 61 15 cb 20 7f bf eb cf 76 05 27 a2 59 08 6d 45 37 ... 12245 more bytes>,
  byteLength: 12345
}
done.

What do you see instead?

When run in 22.04 (host OS and docker confirmed)

root@99eba3b487e3:/test# node cryptoTest.js 
node[3554]: ../src/crypto/crypto_cipher.h:262:v8::Maybe<bool> node::crypto::CipherJob<CipherTraits>::ToResult(v8::Local<v8::Value>*, v8::Local<v8::Value>*) [with CipherTraits = node::crypto::AESCipherTraits]: Assertion `errors->Empty()' failed.
 1: 0xb09c10 node::Abort() [node]
 2: 0xb09c8e  [node]
 3: 0xc3e0f9  [node]
 4: 0xad4095 node::ThreadPoolWork::ScheduleWork()::{lambda(uv_work_s*, int)#2}::_FUN(uv_work_s*, int) [node]
 5: 0x156015d  [node]
 6: 0x1564936  [node]
 7: 0x1577064  [node]
 8: 0x1565288 uv_run [node]
 9: 0xa43dd5 node::SpinEventLoop(node::Environment*) [node]
10: 0xb4bdb6 node::NodeMainInstance::Run(node::EnvSerializeInfo const*) [node]
11: 0xacd592 node::Start(int, char**) [node]
12: 0x7fd500651d90  [/lib/x86_64-linux-gnu/libc.so.6]
13: 0x7fd500651e40 __libc_start_main [/lib/x86_64-linux-gnu/libc.so.6]
14: 0xa4067c  [node]
Aborted (core dumped)
root@99eba3b487e3:/test# ^C

Additional information

A quick mini example is based off:
https://stackoverflow.com/questions/25725596/use-window-crypto-in-nodejs-code

This issue was found in production code dealing with subtle, decrypt. The toy example is just to make the issue more concrete and easier to test. We are seeing this issue with other methods, AES-CTR, AES-GCM

[HiveTechDev]

potentially related (similar error output) #38883

[targos]

@nodejs/crypto

[bnoordhuis]

@Koulwa can you try with the node binary from https://nodejs.org/ instead of the nodesource build? edit: please post the stack trace it prints, assuming it also fails.

[HiveTechDev]

@Koulwa can you try with the node binary from https://nodejs.org/ instead of the nodesource build? edit: please post the stack trace it prints, assuming it also fails.

Sure thing. Same setup as before (Docker 22.04 jammy)

Heres's that output.

root@c14a9eb045aa:/test/node-v16.15.0-linux-x64/bin# ./node ../../cryptoTest.js 
./node[2574]: ../src/crypto/crypto_cipher.h:262:v8::Maybe<bool> node::crypto::CipherJob<CipherTraits>::ToResult(v8::Local<v8::Value>*, v8::Local<v8::Value>*) [with CipherTraits = node::crypto::AESCipherTraits]: Assertion `errors->Empty()' failed.
 1: 0xb09c10 node::Abort() [./node]
 2: 0xb09c8e  [./node]
 3: 0xc3e0f9  [./node]
 4: 0xad4095 node::ThreadPoolWork::ScheduleWork()::{lambda(uv_work_s*, int)#2}::_FUN(uv_work_s*, int) [./node]
 5: 0x156015d  [./node]
 6: 0x1564936  [./node]
 7: 0x1577064  [./node]
 8: 0x1565288 uv_run [./node]
 9: 0xa43dd5 node::SpinEventLoop(node::Environment*) [./node]
10: 0xb4bdb6 node::NodeMainInstance::Run(node::EnvSerializeInfo const*) [./node]
11: 0xacd592 node::Start(int, char**) [./node]
12: 0x7fcff2733d90  [/lib/x86_64-linux-gnu/libc.so.6]
13: 0x7fcff2733e40 __libc_start_main [/lib/x86_64-linux-gnu/libc.so.6]
14: 0xa4067c  [./node]
Aborted (core dumped)
root@c14a9eb045aa:/test/node-v16.15.0-linux-x64/bin# 

[bnoordhuis]

Thanks. This indeed seems to be related to #38883. The fix from #38913 was applied to the CBC and GCM code paths but not CTR.

This check looks defective to me:

node/src/crypto/crypto_cipher.h

Lines 261 to 262 in ec1c616

	if (out_.size() > 0 || errors->Empty()) {
	CHECK(errors->Empty());

It's saying "EITHER we have output and no errors OR no output and one or more errors" but there can be both output and errors, e.g., if if the final block isn't properly padded.

@nodejs/crypto do you concur?

[majherek]

any solution?

[leviwolfe]

I ran into this error on previously working code and found this issue. @Koulwa's cryptoTest.js script unfortunately crashes with the same Assertion `errors->Empty()' error for me on Windows 10 with node v16.15.1. Here is my stack trace if it helps:

C:\temp\test>ver

Microsoft Windows [Version 10.0.19044.1706]

C:\temp\test>node -v
v16.15.1

C:\temp\test>node cryptoTest.js
Command Prompt - node  cryptoTest.js[2280]: c:\ws\src\crypto\crypto_cipher.h:262: Assertion `errors->Empty()' failed.
 1: 00007FF7470D79CF v8::internal::CodeObjectRegistry::~CodeObjectRegistry+114207
 2: 00007FF747066096 DSA_meth_get_flags+65542
 3: 00007FF747066451 DSA_meth_get_flags+66497
 4: 00007FF746F3E326 uv_loop_size+358
 5: 00007FF746F3CE46 v8::internal::Debug::ArchiveSpacePerThread+6998
 6: 00007FF74713A770 uv_timer_stop+736
 7: 00007FF74713A947 uv_timer_stop+1207
 8: 00007FF747136EDB uv_async_send+331
 9: 00007FF74713666C uv_loop_init+1292
10: 00007FF74713680A uv_run+202
11: 00007FF747105675 node::SpinEventLoop+309
12: 00007FF74701E853 v8::internal::Isolate::stack_guard+53843
13: 00007FF74709AA8C node::Start+220
14: 00007FF746EB897C RC4_options+348284
15: 00007FF747F1FDB8 v8::internal::compiler::RepresentationChanger::Uint32OverflowOperatorFor+14472
16: 00007FF9D8FF7034 BaseThreadInitThunk+20
17: 00007FF9DA822651 RtlUserThreadStart+33

[HiveTechDev]

Any update on this?

[xkid1]

I have the same issue ubuntu 22.04

node: 16

[tniessen]

I haven't been able to reproduce this on Ubuntu 20.04 or Ubuntu 22.04. Could you please post the output of node -v and node -p process.versions and uname -a, as well as code that demonstrates the problem?

[xkid1]

ode -p process.versions

Please see attached picture

[bnoordhuis]

@xkid1 Please try again with the latest v16.x release.

[xkid1]

@xkid1 Please try again with the latest v16.x release.

I will try node:16.17.0,

then wait for may feedback

[xkid1]

@bnoordhuis node 16.17.0 is now working

[bnoordhuis]

Cool, good to hear. I'll close this then.

[bnoordhuis]

Oh, @tniessen, what are your thoughts on #42919 (comment)?