Skip to content

Commit

Permalink
Fix UAF caused by strInput being deallocated at the end of the if
Browse files Browse the repository at this point in the history
… block

Observed behavior was that the crc function would return a random number for string input.
  • Loading branch information
ivan committed Jun 1, 2019
1 parent 1b79bb4 commit d39bdd7
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions src/crc32c.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -54,15 +54,15 @@ Napi::Value sse42_crc(const Napi::CallbackInfo &info) {
Napi::Buffer<char> data = info[0].As<Napi::Buffer<char>>();
buf = (const char *)data.Data();
len = (size_t)data.Length();
return Napi::Number::New(env, sse42_calculate(crc, buf, len));
} else if (info[0].IsString()) {
std::string strInput = info[0].As<Napi::String>().Utf8Value();
buf = (const char *)strInput.c_str();
len = (size_t)strInput.length();
return Napi::Number::New(env, sse42_calculate(crc, buf, len));
} else {
throw Napi::TypeError::New(env, "input is not a string/buffer!");
}

return Napi::Number::New(env, sse42_calculate(crc, buf, len));
}

/**
Expand Down Expand Up @@ -94,15 +94,15 @@ Napi::Value table_crc(const Napi::CallbackInfo &info) {
Napi::Buffer<char> data = info[0].As<Napi::Buffer<char>>();
buf = (const char *)data.Data();
len = (size_t)data.Length();
return Napi::Number::New(env, table_calculate(crc, buf, len));
} else if (info[0].IsString()) {
std::string strInput = info[0].As<Napi::String>().Utf8Value();
buf = (const char *)strInput.c_str();
len = (size_t)strInput.length();
return Napi::Number::New(env, table_calculate(crc, buf, len));
} else {
throw Napi::TypeError::New(env, "input is not a string/buffer!");
}

return Napi::Number::New(env, table_calculate(crc, buf, len));
}

/**
Expand Down

0 comments on commit d39bdd7

Please sign in to comment.