Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

src: fix double free reported by coverity #51046

Closed
wants to merge 2 commits into from

Conversation

mhdawson
Copy link
Member

@mhdawson mhdawson commented Dec 4, 2023

Fix double free reported by coverity. ToBufferEndian() in node_i18n.cc was the only caller of Buffer::New() passing in a MaybeStackBuffer. Coverity reported a double free because there were paths in which the src buffer would be deleted by both the destruction of the MaybeStackBuffer and by the Buffer which was done even in failure cases for Buffer::New().

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Dec 4, 2023
@mhdawson
Copy link
Member Author

mhdawson commented Dec 4, 2023

There are 3 similar coverity reports to this in node_i18n.cc. This is not new (initial report was in 2022) and should only have affected the error case which is unlikely.

2. Condition U_SUCCESS(*status), taking true branch.
210  if (U_SUCCESS(*status)) {
211    destbuf.SetLength(len);
   	3. freed_arg: ToBufferEndian frees destbuf.buf_. [[hide details](https://scan9.scan.coverity.com/eventId=9536861-3&modelId=9536861-1&fileInstanceId=124810153&filePath=%2Fsrc%2Fnode_i18n.cc&fileStart=107&fileEnd=120)]
212    ret = ToBufferEndian(env, &destbuf);
[/src/node_i18n.cc](https://scan9.scan.coverity.com/fileInstanceId=/124810153&defectInstanceId=/9536861&modelId=/9536861-1)
107MaybeLocal<Object> ToBufferEndian(Environment* env, MaybeStackBuffer<T>* buf) {
   	1. freed_arg: New frees parameter buf->buf_. [[show details](https://scan9.scan.coverity.com/eventId=9536861-4&modelId=9536861-2&fileInstanceId=124809979&filePath=%2Fsrc%2Fnode_internals.h&fileStart=187&fileEnd=205)]
108  MaybeLocal<Object> ret = Buffer::New(env, buf);
109  if (ret.IsEmpty())
110    return ret;
111
112  static_assert(sizeof(T) == 1 || sizeof(T) == 2,
113                "Currently only one- or two-byte buffers are supported");
114  if (sizeof(T) > 1 && IsBigEndian()) {
115    SPREAD_BUFFER_ARG(ret.ToLocalChecked(), retbuf);
116    SwapBytes16(retbuf_data, retbuf_length);
117  }
118
119  return ret;
120}
213  }
   	
CID 275315 (#1 of 1): Double free (USE_AFTER_FREE)
4. double_free: Calling ~MaybeStackBuffer frees pointer destbuf.buf_ which has already been freed. [[show details](https://scan9.scan.coverity.com/eventId=9536861-14&modelId=9536861-5&fileInstanceId=124810940&filePath=%2Fsrc%2Futil.h&fileStart=490&fileEnd=493)]
214  return ret;
215}

Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
@mhdawson mhdawson added the request-ci Add this label to start a Jenkins CI on a PR. label Dec 7, 2023
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Dec 7, 2023
@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

mhdawson added a commit that referenced this pull request Dec 11, 2023
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #51046
Reviewed-By: James M Snell <[email protected]>
@mhdawson
Copy link
Member Author

Landed in 9e87091

@mhdawson mhdawson closed this Dec 11, 2023
RafaelGSS pushed a commit that referenced this pull request Dec 15, 2023
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #51046
Reviewed-By: James M Snell <[email protected]>
@RafaelGSS RafaelGSS mentioned this pull request Dec 15, 2023
richardlau pushed a commit that referenced this pull request Mar 25, 2024
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #51046
Reviewed-By: James M Snell <[email protected]>
@richardlau richardlau mentioned this pull request Mar 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants