Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Internal domain function can be used to cause segfaults #14519

Closed
tniessen opened this issue Jul 27, 2017 · 0 comments
Closed

Internal domain function can be used to cause segfaults #14519

tniessen opened this issue Jul 27, 2017 · 0 comments
Labels
domain Issues and PRs related to the domain subsystem. process Issues and PRs related to the process subsystem.

Comments

@tniessen
Copy link
Member

  • Version: master
  • Platform: all
  • Subsystem: process / domain

The following snippet will cause a segmentation fault on master:

// This is an evil array
const array = [0];
Object.defineProperty(array, '0', {
  get() {
    throw new Error();
  }
});

// Trick the environment into thinking it is inside a domain
process._setupDomainUse(array, [])[0] = 1;

// This call will try to use the pretended domain and segfault
require('crypto').randomBytes(1024, () => { });

// The process will segfault above so this never gets printed
console.log('Still working');

This is caused by using env->domain_array->Get(0) instead of the safe variant of the Get function. This is not limited to randomBytes, there is a number of files with similar code.

The priority of this issue is very low as it uses undocumented internal functions to intentionally cause a segmentation fault. I am documenting this for the sake of completeness.

@tniessen tniessen added domain Issues and PRs related to the domain subsystem. process Issues and PRs related to the process subsystem. labels Jul 27, 2017
tniessen added a commit to tniessen/node that referenced this issue Jul 30, 2017
addaleax pushed a commit that referenced this issue Aug 2, 2017
PR-URL: #14548
Fixes: #14519
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Timothy Gu <timothygu99@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
domain Issues and PRs related to the domain subsystem. process Issues and PRs related to the process subsystem.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants
@tniessen and others