crypto: prevent Sign::SignFinal from crashing

tniessen · targos · commit d9825c7a16ca · 2018-07-18T13:00:01.000+02:00
The validation logic could be tricked into assuming an option was valid using malicious getters, leading to an invalid value being passed to the C++ layer, thus crashing the process. PR-URL: #21815 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com> Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>
diff --git a/lib/internal/crypto/sig.js b/lib/internal/crypto/sig.js
@@ -57,10 +57,11 @@ function getSaltLength(options) {
 
 function getIntOption(name, defaultValue, options) {
 if (options.hasOwnProperty(name)) {
- if (options[name] === options[name] >> 0) {
- return options[name];
+ const value = options[name];
+ if (value === value >> 0) {
+ return value;
 } else {
- throw new ERR_INVALID_OPT_VALUE(name, options[name]);
+ throw new ERR_INVALID_OPT_VALUE(name, value);
 }
 }
 return defaultValue;

Original file line number	Diff line number	Diff line change
`@@ -57,10 +57,11 @@ function getSaltLength(options) {`
`57`	`57`
`58`	`58`	`functiongetIntOption(name,defaultValue,options){`
`59`	`59`	`if(options.hasOwnProperty(name)){`
`60`		`-if(options[name]===options[name]>>0){`
`61`		`-returnoptions[name];`
	`60`	`+constvalue=options[name];`
	`61`	`+if(value===value>>0){`
	`62`	`+returnvalue;`
`62`	`63`	`}else{`
`63`		`-thrownewERR_INVALID_OPT_VALUE(name,options[name]);`
	`64`	`+thrownewERR_INVALID_OPT_VALUE(name,value);`
`64`	`65`	`}`
`65`	`66`	`}`
`66`	`67`	`returndefaultValue;`