Skip to content

src: avoid OOB read in URL parser#33640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
addaleax wants to merge 2 commits into from
Closed

src: avoid OOB read in URL parser #33640

addaleax wants to merge 2 commits into from

Conversation

@addaleax
Copy link
Member

@addaleaxaddaleax commented May 29, 2020

This is not a big concern, because right now, all (non-test) inputs
to the parser are '\0'-terminated, but we should be future-proof
here and not perform these OOB reads.

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • commit message follows commit guidelines

@addaleax
src: avoid OOB read in URL parser
8f0dd0f
This is not a big concern, because right now, all (non-test) inputs to the parser are `'\0'`-terminated, but we should be future-proof here and not perform these OOB reads.
@nodejs-github-botnodejs-github-bot added the c++ Issues and PRs that require attention from people who are familiar with C++. label May 29, 2020
@addaleaxaddaleax added the whatwg-url Issues and PRs related to the WHATWG URL implementation. label May 29, 2020
@nodejs-github-bot
Copy link
Collaborator

nodejs-github-bot commented May 30, 2020

CI: https://ci.nodejs.org/job/node-test-pull-request/31642/

@BridgeARBridgeAR added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label May 30, 2020
@jasnelljasnell added the fast-track PRs that do not need to wait for 48 hours to land. label May 30, 2020
@jasnell
Copy link
Member

jasnell commented May 30, 2020

Passing CI, plenty of sign-off, no reason for this to sit for long. fast track?

jasnell pushed a commit that referenced this pull request May 30, 2020
@addaleax@jasnell
src: avoid OOB read in URL parser
3f32126
This is not a big concern, because right now, all (non-test) inputs to the parser are `'\0'`-terminated, but we should be future-proof here and not perform these OOB reads. PR-URL: #33640 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Gus Caplan <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
@jasnell
Copy link
Member

jasnell commented May 30, 2020

Landed in 3f32126

@jasnelljasnell closed this May 30, 2020
This was referenced Jun 3, 2020
Merged
Closed
codebytere pushed a commit that referenced this pull request Jun 18, 2020
@addaleax@codebytere
src: avoid OOB read in URL parser
a8824ae
This is not a big concern, because right now, all (non-test) inputs to the parser are `'\0'`-terminated, but we should be future-proof here and not perform these OOB reads. PR-URL: #33640 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Gus Caplan <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
@codebyterecodebytere mentioned this pull request Jun 28, 2020
Merged
codebytere pushed a commit that referenced this pull request Jun 30, 2020
@addaleax@codebytere
src: avoid OOB read in URL parser
6cadb00
This is not a big concern, because right now, all (non-test) inputs to the parser are `'\0'`-terminated, but we should be future-proof here and not perform these OOB reads. PR-URL: #33640 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Gus Caplan <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
codebytere pushed a commit that referenced this pull request Jul 9, 2020
@addaleax@codebytere
src: avoid OOB read in URL parser
e3beb78
This is not a big concern, because right now, all (non-test) inputs to the parser are `'\0'`-terminated, but we should be future-proof here and not perform these OOB reads. PR-URL: #33640 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Gus Caplan <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
@codebyterecodebytere mentioned this pull request Jul 13, 2020
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes

@benjamingrbenjamingrbenjamingr approved these changes

@cjihrigcjihrigcjihrig approved these changes

@BridgeARBridgeARBridgeAR approved these changes

+2 more reviewers

@sam-githubsam-githubsam-github approved these changes

@devsnekdevsnekdevsnek approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

author readyPRs that have at least one approval, no pending requests for changes, and a CI started.c++Issues and PRs that require attention from people who are familiar with C++.fast-trackPRs that do not need to wait for 48 hours to land.whatwg-urlIssues and PRs related to the WHATWG URL implementation.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@addaleax@nodejs-github-bot@jasnell@sam-github@benjamingr@cjihrig@devsnek@BridgeAR