zlib: validate pledgedSrcSize as a safe integer

pledgedSrcSize represents an exact byte count. Reject values that are
not non-negative safe integers instead of silently ignoring or coercing
them through IntegerValue().
Apply the same validation to zlib/iter and retain a native validation
check for internal callers.
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64604Fixes: #64603
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Jan Martin <jan.krems@gmail.com>

Author: Archkon

doc/api/zlib.md

@@ -784,8 +784,9 @@ const stream = zlib.createZstdCompress({
 #### Pledged Source Size
 
 It's possible to specify the expected total size of the uncompressed input via
-`opts.pledgedSrcSize`. If the size doesn't match at the end of the input,
-compression will fail with the code `ZSTD_error_srcSize_wrong`.
+`opts.pledgedSrcSize`, which must be a non-negative safe integer. If the size
+doesn't match at the end of the input, compression will fail with the code
+`ZSTD_error_srcSize_wrong`.
 
 #### Decompressor options
 
@@ -1927,7 +1928,8 @@ added: v25.9.0
 `ZSTD_btultra2`.
  See the [Zstd compressor options][] in the zlib documentation for the
  full list.
-*`pledgedSrcSize` {number} Expected uncompressed size (optional hint).
+*`pledgedSrcSize` {number} Expected uncompressed size as a non-negative safe
+ integer (optional hint).
 *`dictionary` {Buffer|TypedArray|DataView}
 * Returns: {Object} A stateful transform.
 

lib/internal/streams/iter/transform.js

@@ -257,16 +257,6 @@ function createZstdHandle(mode, options, processCallback, onError) {
 validateParams(options.params,maxParam,ERR_ZSTD_INVALID_PARAM);
 
 constpledgedSrcSize=options.pledgedSrcSize;
-if(pledgedSrcSize!==undefined){
-if(typeofpledgedSrcSize!=='number'||NumberIsNaN(pledgedSrcSize)){
-thrownewERR_INVALID_ARG_TYPE('options.pledgedSrcSize','number',
-pledgedSrcSize);
-}
-if(pledgedSrcSize<0){
-thrownewERR_OUT_OF_RANGE('options.pledgedSrcSize','>= 0',
-pledgedSrcSize);
-}
-}
 
 consthandle=isCompress ?
 newbinding.ZstdCompress() : newbinding.ZstdDecompress();

lib/zlib.js

@@ -939,7 +939,7 @@ class Zstd extends ZlibBase {
 consthandle=mode===ZSTD_COMPRESS ?
 newbinding.ZstdCompress() : newbinding.ZstdDecompress();
 
-constpledgedSrcSize=opts?.pledgedSrcSize??undefined;
+constpledgedSrcSize=opts?.pledgedSrcSize;
 
 constwriteState=newUint32Array(2);
 

src/node_zlib.cc

@@ -945,9 +945,6 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
  }
 
 staticvoidInit(const FunctionCallbackInfo<Value>& args) {
- Environment* env = Environment::GetCurrent(args);
- Local<Context> context = env->context();
-
 CHECK((args.Length() == 4 || args.Length() == 5) &&
 "init(params, pledgedSrcSize, writeResult, writeCallback[, "
 "dictionary])");
@@ -964,19 +961,24 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
  wrap->InitStream(write_result, write_js_callback);
 
 uint64_t pledged_src_size = ZSTD_CONTENTSIZE_UNKNOWN;
-if (args[1]->IsNumber()) {
-int64_t signed_pledged_src_size;
-if (!args[1]->IntegerValue(context).To(&signed_pledged_src_size)) {
-THROW_ERR_INVALID_ARG_VALUE(wrap->env(),
-"pledgedSrcSize should be an integer");
+if (!args[1]->IsUndefined()) {
+if (!args[1]->IsNumber()) {
+THROW_ERR_INVALID_ARG_TYPE(wrap->env(),
+"pledgedSrcSize must be a number");
+return;
+ }
+if (!IsSafeJsInt(args[1])) {
+THROW_ERR_OUT_OF_RANGE(wrap->env(),
+"pledgedSrcSize must be a safe integer");
 return;
  }
+constint64_t signed_pledged_src_size = args[1].As<Integer>()->Value();
 if (signed_pledged_src_size < 0) {
-THROW_ERR_INVALID_ARG_VALUE(wrap->env(),
-"pledgedSrcSize may not be negative");
+THROW_ERR_OUT_OF_RANGE(wrap->env(),
+"pledgedSrcSize must be non-negative");
 return;
  }
- pledged_src_size = signed_pledged_src_size;
+ pledged_src_size = static_cast<uint64_t>(signed_pledged_src_size);
  }
 
  AllocScope alloc_scope(wrap);

test/parallel/test-stream-iter-validation.js

@@ -353,7 +353,16 @@ async function testAsyncValidation() {
 
 // Zstd pledgedSrcSize
 awaitassert.rejects(consume(compressZstd({pledgedSrcSize: 'bad'})),TYPE);
-awaitassert.rejects(consume(compressZstd({pledgedSrcSize: -1})),RANGE);
+for(constpledgedSrcSizeof[
+NaN,
+Infinity,
+-Infinity,
+1.9,
+-1,
+Number.MAX_SAFE_INTEGER+1,
+]){
+awaitassert.rejects(consume(compressZstd({ pledgedSrcSize })),RANGE);
+}
 }
 
 // =============================================================================

test/parallel/test-zlib-zstd-pledged-src-size.js

@@ -35,3 +35,39 @@ compressWithPledgedSrcSize({ pledgedSrcSize: 42, actualSrcSize: 0 });
 compressWithPledgedSrcSize({pledgedSrcSize: 42,actualSrcSize: 13});
 
 compressWithPledgedSrcSize({pledgedSrcSize: 42,actualSrcSize: 42});
+
+functionassertInvalidPledgedSrcSize(pledgedSrcSize,expected){
+assert.throws(
+()=>zlib.createZstdCompress({ pledgedSrcSize }),
+expected,
+);
+assert.throws(
+()=>zlib.zstdCompressSync('',{ pledgedSrcSize }),
+expected,
+);
+}
+
+for(constpledgedSrcSizeof['1',null]){
+assertInvalidPledgedSrcSize(pledgedSrcSize,{
+name: 'TypeError',
+code: 'ERR_INVALID_ARG_TYPE',
+});
+}
+
+for(constpledgedSrcSizeof[
+NaN,
+Infinity,
+-Infinity,
+1.9,
+-1,
+Number.MAX_SAFE_INTEGER+1,
+]){
+assertInvalidPledgedSrcSize(pledgedSrcSize,{
+name: 'RangeError',
+code: 'ERR_OUT_OF_RANGE',
+});
+}
+
+zlib.createZstdCompress({
+pledgedSrcSize: Number.MAX_SAFE_INTEGER,
+}).destroy();