zlib: prevent uncaught exception in zlibBuffer

If the accumulation of data for the final Buffer is greater than kMaxLength it will throw an un-catchable RangeError. Instead now pass the generated error to the callback. PR-URL: #1811 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Trevor Norris <[email protected]>

Author: targos

lib/zlib.js

@@ -5,6 +5,9 @@ const Transform = require('_stream_transform');
 constbinding=process.binding('zlib');
 constutil=require('util');
 constassert=require('assert').ok;
+constkMaxLength=process.binding('smalloc').kMaxLength;
+constkRangeErrorMessage='Cannot create final Buffer. '+
+'It would be larger than 0x'+kMaxLength.toString(16)+' bytes.';
 
 // zlib doesn't provide these, so kludge them in following the same
 // const naming scheme zlib uses.
@@ -210,10 +213,18 @@ function zlibBuffer(engine, buffer, callback){
 }
 
 functiononEnd(){
-varbuf=Buffer.concat(buffers,nread);
+varbuf;
+varerr=null;
+
+if(nread>=kMaxLength){
+err=newRangeError(kRangeErrorMessage);
+}else{
+buf=Buffer.concat(buffers,nread);
+}
+
 buffers=[];
-callback(null,buf);
 engine.close();
+callback(err,buf);
 }
 }
 
@@ -524,6 +535,11 @@ Zlib.prototype._processChunk = function(chunk, flushFlag, cb){
 throwerror;
 }
 
+if(nread>=kMaxLength){
+this.close();
+thrownewRangeError(kRangeErrorMessage);
+}
+
 varbuf=Buffer.concat(buffers,nread);
 this.close();
 

test/parallel/test-regress-GH-io-1811.js

@@ -0,0 +1,22 @@
+'use strict';
+
+constassert=require('assert');
+
+// Change kMaxLength for zlib to trigger the error
+// without having to allocate 1GB of buffers
+constsmalloc=process.binding('smalloc');
+smalloc.kMaxLength=128;
+constzlib=require('zlib');
+smalloc.kMaxLength=0x3fffffff;
+
+constencoded=newBuffer('H4sIAAAAAAAAA0tMHFgAAIw2K/GAAAAA','base64');
+
+// Async
+zlib.gunzip(encoded,function(err){
+assert.ok(errinstanceofRangeError);
+});
+
+// Sync
+assert.throws(function(){
+zlib.gunzipSync(encoded);
+},RangeError);