Commit 1fe7a1c

Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c

2 files changed

Lines changed: 13 additions & 9 deletions

File tree

‎src/ffi/data.cc‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
}
313311

314312
T converted;
315-
Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
}
402399
} elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
MaybeLocal<Number> number = value->ToNumber(context);
404-
Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
} else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
}
408406
return;
409407
}
410408

411-
converted = static_cast<T>(number_local->Value());
409+
converted = static_cast<T>(value.As<Number>()->Value());
412410
} else {
413411
UNREACHABLE();
414412
}

‎test/ffi/test-ffi-memory.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});

0 commit comments

Comments
 (0)
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Commit 1fe7a1c
Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".
The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.
Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.
Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: #65342Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c
2 files changed
Lines changed: 13 additions & 9 deletions
File tree
‎src/ffi/data.cc‎
Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
 }
313311

314312
 T converted;
315-
 Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
 }
402399
 } elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
 MaybeLocal<Number> number = value->ToNumber(context);
404-
 Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
 } else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
 }
408406
return;
409407
 }
410408

411-
 converted = static_cast<T>(number_local->Value());
409+
 converted = static_cast<T>(value.As<Number>()->Value());
412410
 } else {
413411
UNREACHABLE();
414412
 }
‎test/ffi/test-ffi-memory.js‎
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 1fe7a1c
Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".
The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.
Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.
Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: #65342Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c
2 files changed
Lines changed: 13 additions & 9 deletions
File tree
‎src/ffi/data.cc‎
Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
 }
313311

314312
 T converted;
315-
 Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
 }
402399
 } elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
 MaybeLocal<Number> number = value->ToNumber(context);
404-
 Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
 } else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
 }
408406
return;
409407
 }
410408

411-
 converted = static_cast<T>(number_local->Value());
409+
 converted = static_cast<T>(value.As<Number>()->Value());
412410
 } else {
413411
UNREACHABLE();
414412
 }
‎test/ffi/test-ffi-memory.js‎
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 1fe7a1c
Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".
The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.
Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.
Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: #65342Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c
2 files changed
Lines changed: 13 additions & 9 deletions
File tree
‎src/ffi/data.cc‎
Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
 }
313311

314312
 T converted;
315-
 Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
 }
402399
 } elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
 MaybeLocal<Number> number = value->ToNumber(context);
404-
 Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
 } else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
 }
408406
return;
409407
 }
410408

411-
 converted = static_cast<T>(number_local->Value());
409+
 converted = static_cast<T>(value.As<Number>()->Value());
412410
 } else {
413411
UNREACHABLE();
414412
 }
‎test/ffi/test-ffi-memory.js‎
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Commit 1fe7a1c
Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".
The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.
Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.
Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: #65342Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c
2 files changed
Lines changed: 13 additions & 9 deletions
File tree
‎src/ffi/data.cc‎
Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
 }
313311

314312
 T converted;
315-
 Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
 }
402399
 } elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
 MaybeLocal<Number> number = value->ToNumber(context);
404-
 Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
 } else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
 }
408406
return;
409407
 }
410408

411-
 converted = static_cast<T>(number_local->Value());
409+
 converted = static_cast<T>(value.As<Number>()->Value());
412410
 } else {
413411
UNREACHABLE();
414412
 }
‎test/ffi/test-ffi-memory.js‎
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 1fe7a1c
Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".
The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.
Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.
Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: #65342Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c
2 files changed
Lines changed: 13 additions & 9 deletions
File tree
‎src/ffi/data.cc‎
Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
 }
313311

314312
 T converted;
315-
 Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
 }
402399
 } elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
 MaybeLocal<Number> number = value->ToNumber(context);
404-
 Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
 } else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
 }
408406
return;
409407
 }
410408

411-
 converted = static_cast<T>(number_local->Value());
409+
 converted = static_cast<T>(value.As<Number>()->Value());
412410
 } else {
413411
UNREACHABLE();
414412
 }
‎test/ffi/test-ffi-memory.js‎
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 1fe7a1c
Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".
The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.
Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.
Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: #65342Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c
2 files changed
Lines changed: 13 additions & 9 deletions
File tree
‎src/ffi/data.cc‎
Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
 }
313311

314312
 T converted;
315-
 Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
 }
402399
 } elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
 MaybeLocal<Number> number = value->ToNumber(context);
404-
 Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
 } else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
 }
408406
return;
409407
 }
410408

411-
 converted = static_cast<T>(number_local->Value());
409+
 converted = static_cast<T>(value.As<Number>()->Value());
412410
 } else {
413411
UNREACHABLE();
414412
 }
‎test/ffi/test-ffi-memory.js‎
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Commit 1fe7a1c
Browse files
soulee-devaduh95
soulee-dev
authored and
aduh95
committed
ffi: validate the value passed to the float setters
setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".
The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.
Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.
Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: #65342Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 9572a0b commit 1fe7a1c
2 files changed
Lines changed: 13 additions & 9 deletions
File tree
‎src/ffi/data.cc‎
Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ using v8::ArrayBuffer;
1616
using v8::ArrayBufferView;
1717
using v8::BackingStore;
1818
using v8::BigInt;
19-
using v8::Context;
2019
using v8::FunctionCallbackInfo;
2120
using v8::Integer;
2221
using v8::Isolate;
2322
using v8::Just;
2423
using v8::JustVoid;
2524
using v8::Local;
2625
using v8::Maybe;
27-
using v8::MaybeLocal;
2826
using v8::NewStringType;
2927
using v8::Nothing;
3028
using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
312310
 }
313311

314312
 T converted;
315-
 Local<Context> context = env->context();
316313

317314
ifconstexpr (std::is_same_v<T, int8_t>) {
318315
int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
400397
return;
401398
 }
402399
 } elseifconstexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
403-
 MaybeLocal<Number> number = value->ToNumber(context);
404-
 Local<Number> number_local;
405-
406-
if (!number.ToLocal(&number_local)) {
407-
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
400+
if (!value->IsNumber()) {
401+
ifconstexpr (std::is_same_v<T, float>) {
402+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
403+
 } else {
404+
THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
405+
 }
408406
return;
409407
 }
410408

411-
 converted = static_cast<T>(number_local->Value());
409+
 converted = static_cast<T>(value.As<Number>()->Value());
412410
 } else {
413411
UNREACHABLE();
414412
 }
‎test/ffi/test-ffi-memory.js‎
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
273273
assert.throws(()=>ffi.setUint64(ptr,0,-1n),/Valuemustbeauint64/);
274274
assert.throws(()=>ffi.setUint64(ptr,0,2n**64n),/Valuemustbeauint64/);
275275
assert.throws(()=>ffi.setUint64(ptr,0,Number.MAX_SAFE_INTEGER+1),/Valuemustbeauint64/);
276+
assert.throws(()=>ffi.setFloat32(ptr,0,'1.5'),/Valuemustbeafloat/);
277+
assert.throws(()=>ffi.setFloat32(ptr,0,null),/Valuemustbeafloat/);
278+
assert.throws(()=>ffi.setFloat64(ptr,0,'1.5'),/Valuemustbeadouble/);
279+
assert.throws(()=>ffi.setFloat64(ptr,0,true),/Valuemustbeadouble/);
280+
assert.throws(()=>ffi.setFloat64(ptr,0,{}),/Valuemustbeadouble/);
281+
assert.throws(()=>ffi.setFloat64(ptr,0,{valueOf: common.mustNotCall()}),/Valuemustbeadouble/);
276282
assert.throws(()=>ffi.exportString(1,ptr,4),{code: 'ERR_INVALID_ARG_TYPE'});
277283
assert.throws(()=>ffi.exportString('ok',ptr,-1),{code: 'ERR_OUT_OF_RANGE'});
278284
assert.throws(()=>ffi.exportString('ok',ptr,4,1),{code: 'ERR_INVALID_ARG_TYPE'});
0 commit comments
Comments
 (0)