Repository navigation
child_process.spawnSync is memory unsafe and can be used to dump core #8539
Description
- Version: 6.5.0
- Platform:
- Subsystem: child_process
child_process.spawnSync is memory unsafe and segfaults when given an array/object for the file argument with a throwing toString definition.
This doesn't seem like a serious security vulnerability (hence my reporting here), but can certainly be used to cause DOS and it might be nice to have a stdlib that is memory safe.
const file = {};
file.toString = () => { throw 'w00t'; };
const child_process = require('child_process');
child_process.spawnSync(file);
// causes ToString in src/spawn_sync.cc:933 to return empty handle which is then
// used on line 933 and thus leads to SEGFAULT
Activity
[-]`child_process.spawnSync` is memory unsafe and segfaults when given an array/object for the file argument with a throwing toString definition. [/-][+]`child_process.spawnSync` is memory unsafe and can be used to dump core[/+][-]`child_process.spawnSync` is memory unsafe and can be used to dump core[/-][+]child_process.spawnSync is memory unsafe and can be used to dump core[/+]test: add known issue test for nodejs#8539
imyller commentedon Sep 15, 2016
@deian Thank you for reporting this.
Ideas for fixing this /cc @bnoordhuis, @cjihrig
imyller commentedon Sep 15, 2016
This is a known issue and affects most C++ API functions accepting non-primitive values.
For more information:
#7902 (comment)
cjihrig commentedon Sep 15, 2016
I'm working on some validation in #8312. I can add a check that the file is a string there.
src: add handle check to spawn_sync
child_process: improve input validation
src: remove redundant spawn/spawnSync type checks
src: add handle check to spawn_sync
child_process: improve input validation
src: remove redundant spawn/spawnSync type checks