Commit 992af05

Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`, leaving no room for the terminating NUL byte. For a single-byte prefix long enough to force the heap allocation path (length + 6 > the stack-buffer threshold), the terminating NUL was written one byte past the end of the buffer -- a 1-byte heap-buffer-overflow flagged by AddressSanitizer. Allocate room for the terminating NUL, copy the suffix, and use SetLengthAndZeroTerminate to set the correct length and write the terminator, following the MaybeStackBuffer paradigm used elsewhere in this file. Signed-off-by: frandle331-yh <s1240100@gmail.com> PR-URL: #64770 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05

1 file changed

Lines changed: 5 additions & 4 deletions

File tree

‎src/node_file.cc‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments

Comments
 (0)
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Commit 992af05
Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
File tree
‎src/node_file.cc‎
Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
 BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
 tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
 tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
 tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 992af05
Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
File tree
‎src/node_file.cc‎
Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
 BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
 tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
 tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
 tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 992af05
Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
File tree
‎src/node_file.cc‎
Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
 BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
 tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
 tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
 tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Commit 992af05
Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
File tree
‎src/node_file.cc‎
Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
 BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
 tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
 tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
 tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 992af05
Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
File tree
‎src/node_file.cc‎
Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
 BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
 tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
 tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
 tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 992af05
Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
File tree
‎src/node_file.cc‎
Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
 BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
 tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
 tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
 tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Commit 992af05
Browse files
frandle331-yhaduh95
frandle331-yh
authored and
aduh95
committed
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
File tree
‎src/node_file.cc‎
Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
36493649
CHECK_GE(argc, 2);
36503650

36513651
 BufferValue tmpl(isolate, args[0]);
3652-
staticconstexprconstchar* const suffix = "XXXXXX";
3653-
constauto length = tmpl.length();
3654-
 tmpl.AllocateSufficientStorage(length + strlen(suffix));
3655-
snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix);
3652+
constauto prefix_length = tmpl.length();
3653+
staticconstexpr std::string_view suffix = "XXXXXX";
3654+
 tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
3655+
memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
3656+
 tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());
36563657

36573658
CHECK_NOT_NULL(*tmpl);
36583659

0 commit comments
Comments
 (0)