镜像站点 · 本页由第三方 GitHub 只读镜像提供，非 GitHub 官方站点，不接受任何登录或凭据输入。前往 github.com
Skip to content

process.setuid results in an abort #32750

Closed
Closed
process.setuid results in an abort#32750
Labels
confirmed-bugIssues and PRs for confirmed bugs.

Description

@zyscoder
zyscoder
opened on Apr 10, 2020
  • Version: v12.16.0
  • Platform: Linux vul337 4.15.0-91-generic new design of error handling #92-Ubuntu SMP Fri Feb 28 11:09:48 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
  • Subsystem: process

What steps will reproduce the bug?

Directly run the following code snippet using node:

require('process').setuid(-0)

How often does it reproduce? Is there a required condition?

No. This potential bug can always be reproduced.

What is the expected behavior?

The argument to 'process.setuid' should be a Uint32 or string value, but we passed a -0 into it. The function should throw an exception or other similar error-reporting stuff rather than crash the whole nodejs process.

What do you see instead?

This is the stack dump produced during abort:

./node[37487]: ../src/node_credentials.cc:247:void node::credentials::SetUid(const FunctionCallbackInfo<v8::Value> &): Assertion `args[0]->IsUint32() || args[0]->IsString()' failed.
 1: 0x13f9b30 node::Abort() [./node]
 2: 0x13f9709  [./node]
 3: 0x13ea56b  [./node]
 4: 0x17b379c v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo) [./node]
 5: 0x17b23d5  [./node]
 6: 0x17b1092  [./node]
 7: 0x2717a59  [./node]
[2]    37487 abort      ./node

Additional information

Activity

  1. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    I can recreate this on master, v10.x prints a proper error message, so looks like a regression to me

  2. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    definition of unsigned int seem to have diverged between JS and C++? looks like the check passed in the former, but failed later?

    node/lib/internal/validators.js

    Line 101 in 203776f

    const validateUint32 = hideStackFrames((value, name, positive) => {

    node/src/node_credentials.cc

    Line 247 in 203776f

    CHECK(args[0]->IsUint32() || args[0]->IsString());

  3. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    failed later -> failed * in * later

  4. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member
    node --expose-internals -e 'require("internal/validators").validateInt32(-0)'

    does not throw, implies this method (validateInt32) does not consider IsMinusZero which IsUint32 of v8 does.

  5. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    validateInt32 hasn't changed between (passing and failing) versions:

    node/lib/internal/validators.js

    Line 83 in b023d61

    const validateInt32 = hideStackFrames(

    does this imply IsUint32 has changed its meaning in V8? that doesn't sound logical!

  6. zyscoder
    closed this as completedon Apr 10, 2020
  7. zyscoder
    reopened this on Apr 10, 2020

  8. zyscoder commented on Apr 10, 2020

    @zyscoder
    zyscoder
    on Apr 10, 2020
    Author

    My team is trying to find bugs and vulnerabilities at the interface between js and c++, and we think this problem of inconsistency is an interesting study case for us. Can you give us a confirmation for this bug? As proof for us to make a discussion in our work.

  9. gireeshpunathil
    added
    confirmed-bugIssues and PRs for confirmed bugs.
    on Apr 10, 2020

  10. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    @zyscoder - that is an interesting area to research, good luck! I tagged it as bug

    /cc @nodejs/v8 in case if there is an obvious explanation.

  11. himself65 commented on Apr 10, 2020

    @himself65
    himself65
    on Apr 10, 2020 · Hidden as off-topic

  12. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    bisecting now.

  13. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    bisect is pointing to the commit(s) in #19973 /cc @targos

  14. targos commented on Apr 10, 2020

    @targos
    targos
    on Apr 10, 2020
    Member

    Interesting! That problem is not only present in process.setuid. The following also fails on Node.js 10:

    > node -e "require('fs').chownSync('test', -0, -0)"    
src\node_file.cc:2029: Assertion `args[1]->IsUint32()' failed.

    V8 always returns false (and it's not new) for IsInt32 and IsUint32 methods.

    I see two things that we can do:

    • Throw in our int32/uint32 validators if -0 is passed (potentially breaking change)
    • Make sure we coerce -0 to 0 either in the validator itself or before passing the value to C++

    Thoughts?

  15. gireeshpunathil commented on Apr 10, 2020

    @gireeshpunathil
    gireeshpunathil
    on Apr 10, 2020
    Member

    technically -0 is signed, so throwing from uint32 validator makes sense to me!

  16. bnoordhuis commented on Apr 10, 2020

    @bnoordhuis
    bnoordhuis
    on Apr 10, 2020
    Member

    The counterargument is that 0 and -0 are indistinguishable (i.e., 0 === -0) except when checking with Object.is(). Coercion to positive 0 seems like the principle of least surprise to me.

  17. HarshithaKP
    added a commit that references this issue on Apr 14, 2020

    lib: coerce `-0` into `0` for process APIs

    c2dfd02
  18. jasnell
    added a commit that references this issue on Jan 4, 2021

    process: passing -1 to setuid/setgid should not abort

    30ecea9
  19. jasnell
    closed this as completedin 421279bon Jan 9, 2021
  20. danielleadams
    added a commit that references this issue on Jan 12, 2021

    process: passing -1 to setuid/setgid should not abort

    94afc3e
  21. targos
    added a commit that references this issue on May 1, 2021

    process: passing -1 to setuid/setgid should not abort

    4305759
  22. MayaLekova
    added a commit that references this issue on May 22, 2026

    process: passing -1 to setuid/setgid should not abort

    421279b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    confirmed-bugIssues and PRs for confirmed bugs.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions