ffi: reject detached ArrayBuffers as pointers

Reject detached ArrayBuffers and ArrayBuffer views in getRawPointer()
and FFI pointer argument conversion. This prevents detached backing
stores from being silently passed to native functions as null pointers.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #65083Fixes: #65082
Reviewed-By: Paolo Insogna <paolo@cowtech.it>

Author: trivikr

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);

lib/internal/ffi/fast-api.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const{
+ ArrayBufferPrototypeGetDetached,
  ArrayPrototypeIncludes,
+ DataViewPrototypeGetBuffer,
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
  SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
+ TypedArrayPrototypeGetBuffer,
 }=primordials;
 
 const{
@@ -16,7 +19,9 @@ const {
 
 const{
  isAnyArrayBuffer,
+ isArrayBuffer,
  isArrayBufferView,
+ isDataView,
 }=require('internal/util/types');
 
 const{
@@ -167,6 +172,28 @@ function getStringConversionPointer(state, value, index) {
 returnentry.pointer;
 }
 
+functiongetRawPointerArg(value,index){
+letbuffer;
+letisView=false;
+if(isArrayBuffer(value)){
+buffer=value;
+}elseif(isArrayBufferView(value)){
+isView=true;
+buffer=isDataView(value) ?
+DataViewPrototypeGetBuffer(value) :
+TypedArrayPrototypeGetBuffer(value);
+}
+
+if(buffer!==undefined&&isArrayBuffer(buffer)&&
+ArrayBufferPrototypeGetDetached(buffer)){
+throwFFIArgError(isView ?
+`Argument ${index} is an ArrayBufferView backed by a detached ArrayBuffer` :
+`Argument ${index} is a detached ArrayBuffer`);
+}
+
+returngetRawPointer(value);
+}
+
 functionconvertPointerArg(type,value,stringState,index){
 validateFastPointerArg(type,value,index);
 if(needsNullPointerConversion(type)&&
@@ -177,7 +204,7 @@ function convertPointerArg(type, value, stringState, index) {
 returngetStringConversionPointer(stringState,value,index);
 }
 if(hasPointerMemoryArg(type,value)){
-returngetRawPointer(value);
+returngetRawPointerArg(value,index);
 }
 // Pointer-like values (e.g. BigInt addresses) are passed through, matching
 // ToFFIArgument in src/ffi/types.cc and the single-argument fast path.
@@ -287,7 +314,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
 if(fastBufferInvoke!==undefined){
 returnfastBufferInvoke(arg);
 }
-arg=getRawPointer(arg);
+arg=getRawPointerArg(arg,0);
 }
 returnrawFn(arg);
 };

src/ffi/data.cc

@@ -685,7 +685,7 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
  args[0]->IsArrayBufferView()) {
  view.ReadValue(args[0]);
 if (view.WasDetached()) {
-THROW_ERR_INVALID_ARG_VALUE(env, "Invalid ArrayBufferView backing store");
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
 return;
  }
  } else {
@@ -749,15 +749,26 @@ void GetRawPointer(const FunctionCallbackInfo<Value>& args) {
  std::shared_ptr<BackingStore> store;
 
 if (args[0]->IsArrayBuffer()) {
- store = args[0].As<ArrayBuffer>()->GetBackingStore();
+ Local<ArrayBuffer> buffer = args[0].As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(env, "ArrayBuffer is detached");
+return;
+ }
+ store = buffer->GetBackingStore();
  } elseif (args[0]->IsSharedArrayBuffer()) {
  store = args[0].As<SharedArrayBuffer>()->GetBackingStore();
  } elseif (args[0]->IsArrayBufferView()) {
+ Local<ArrayBufferView> view = args[0].As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "ArrayBufferView is backed by a detached ArrayBuffer");
+return;
+ }
 // Access the store here to ensure that it exists. Small typed arrays
 // may not have a store until this point and can instead be stored
 // entirely in-heap.
- store = args[0].As<ArrayBufferView>()->Buffer()->GetBackingStore();
- offset = args[0].As<ArrayBufferView>()->ByteOffset();
+ store = view->Buffer()->GetBackingStore();
+ offset = view->ByteOffset();
  } else {
 THROW_ERR_INVALID_ARG_TYPE(
  env,

src/ffi/fast.cc

@@ -246,18 +246,45 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 // returns zero after throwing, preventing the native target from seeing an
 // invalid pointer value.
 constexpruintptr_tkInvalidBuffer = std::numeric_limits<uintptr_t>::max();
+ v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
 // Accept only memory-backed JS values in the native helper. Other pointer
 // conversions, including strings, stay in the JS wrapper so their temporary
 // lifetime is explicit.
 if (value->IsArrayBufferView()) {
+ v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+ }
+returnkInvalidBuffer;
+ }
 returnPointerFromValue(value);
  }
-if (value->IsArrayBuffer() || value->IsSharedArrayBuffer()) {
+if (value->IsArrayBuffer()) {
+if (value.As<v8::ArrayBuffer>()->WasDetached()) {
+if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
+THROW_ERR_INVALID_ARG_VALUE(
+ isolate, "Argument %u is a detached ArrayBuffer", index);
+ }
+returnkInvalidBuffer;
+ }
+returnPointerFromValue(value);
+ }
+if (value->IsSharedArrayBuffer()) {
 returnPointerFromValue(value);
  }
 
- v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
 // No HandleScope is active during a Fast API call, so open one before
 // creating the error object.

src/ffi/types.cc

@@ -700,6 +700,14 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // invalidating that backing store during the active FFI call is
 // unsupported and dangerous.
  Local<ArrayBufferView> view = arg.As<ArrayBufferView>();
+if (view->Buffer()->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"Argument %u is an ArrayBufferView backed by a detached "
+"ArrayBuffer",
+ index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = view->Buffer()->GetBackingStore();
 
 if (!store) {
@@ -721,6 +729,11 @@ Maybe<FFIArgumentCategory> ToFFIArgument(Environment* env,
 // that backing store during the active FFI call is unsupported and
 // dangerous.
  Local<ArrayBuffer> buffer = arg.As<ArrayBuffer>();
+if (buffer->WasDetached()) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env, "Argument %u is a detached ArrayBuffer", index);
+return {};
+ }
  std::shared_ptr<BackingStore> store = buffer->GetBackingStore();
 
 if (!store) {

test/ffi/test-ffi-fast-buffer.js

@@ -98,6 +98,10 @@ test('fast FFI string buffers survive reentrant callbacks', {
 
 test('optimized buffer signatures preserve pointer-like conversions',()=>{
 constlib=newffi.DynamicLibrary(libraryPath);
+constasPointer=lib.getFunction('pointer_to_usize',{
+arguments: ['pointer'],
+return: 'u64',
+});
 constasBuffer=lib.getFunction('pointer_to_usize',{
 arguments: ['buffer'],
 return: 'u64',
@@ -107,6 +111,10 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 return: 'u64',
 });
 
+functioncallPointer(value){
+returnasPointer(value);
+}
+
 functioncallBuffer(value){
 returnasBuffer(value);
 }
@@ -117,17 +125,34 @@ test('optimized buffer signatures preserve pointer-like conversions', () => {
 
 try{
 for(leti=0;i<100_000;i++){
+assert.strictEqual(callPointer(0n),0n);
 assert.strictEqual(callBuffer(0n),0n);
 assert.strictEqual(callArrayBuffer(0n),0n);
 }
 
-for(constcallof[callBuffer,callArrayBuffer]){
+for(constcallof[callPointer,callBuffer,callArrayBuffer]){
 assert.strictEqual(call(null),0n);
 assert.strictEqual(call(undefined),0n);
 assert.notStrictEqual(call('ffi'),0n);
 
 constbytes=Buffer.alloc(1);
 assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+arrayBuffer.transfer();
+
+assert.throws(()=>call(arrayBuffer),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is a detached ArrayBuffer',
+});
+for(constviewof[typedArray,dataView]){
+assert.throws(()=>call(view),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+});
+}
 }
 }finally{
 lib.close();

test/ffi/test-ffi-memory.js

@@ -146,6 +146,41 @@ test('ffi getRawPointer returns raw addresses for byte sources', () => {
 assert.strictEqual(sharedViewPointer,sharedArrayBufferPointer+2n);
 });
 
+test('ffi rejects detached array buffers and views as pointers',()=>{
+constarrayBuffer=newArrayBuffer(8);
+consttypedArray=newUint8Array(arrayBuffer);
+constdataView=newDataView(arrayBuffer);
+
+arrayBuffer.transfer();
+
+assert.throws(()=>ffi.exportArrayBuffer(arrayBuffer,0n,0),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: 'ArrayBuffer is detached',
+});
+
+for(const[value,rawPointerMessage,argumentMessage]of[
+[
+arrayBuffer,
+'ArrayBuffer is detached',
+'Argument 0 is a detached ArrayBuffer',
+],
+ ...[typedArray,dataView].map((view)=>[
+view,
+'ArrayBufferView is backed by a detached ArrayBuffer',
+'Argument 0 is an ArrayBufferView backed by a detached ArrayBuffer',
+]),
+]){
+assert.throws(()=>ffi.getRawPointer(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: rawPointerMessage,
+});
+assert.throws(()=>symbols.pointer_to_usize(value),{
+code: 'ERR_INVALID_ARG_VALUE',
+message: argumentMessage,
+});
+}
+});
+
 test('ffi exportString and exportBuffer copy data into native memory',()=>{
 withAllocations(common.mustCall((alloc)=>{
 conststringPtr=alloc(16);