From be07dd7acb7decd3319a211e2fae79c47241f57a Mon Sep 17 00:00:00 2001 From: Gilson Urbano Date: Tue, 28 Jul 2026 15:00:28 +0000 Subject: [PATCH 1/2] Fix SIGSEGV in readObject on uninitialized Buffer memory --- src/binding.cc | 39 ++++++++++++++++++++++++++++++++------- test/object.js | 22 ++++++++++++++++++++++ 2 files changed, 54 insertions(+), 7 deletions(-) diff --git a/src/binding.cc b/src/binding.cc index 352ec7f..2d506a7 100644 --- a/src/binding.cc +++ b/src/binding.cc @@ -3,6 +3,7 @@ #include #include #include +#include #include "ref-napi.h" @@ -287,6 +288,19 @@ Value IsNull(const CallbackInfo& args) { return Boolean::New(args.Env(), ptr == nullptr); } +/** + * The in-memory layout used to store a weak reference to a JS Object inside + * a raw Buffer. `magic` tags whether this memory has ever been initialized + * by WriteObject, so ReadObject/WriteObject never reinterpret arbitrary + * (uninitialized or otherwise unrelated) Buffer bytes as a live + * Napi::Reference, which previously caused segfaults (see GH #5). + */ +struct ObjectSlot { + uint32_t magic; + Reference ref; +}; +static constexpr uint32_t kObjectMagic = 0x724e4f62; + /** * Retreives a JS Object instance that was previously stored in * the given Buffer instance at the given offset. @@ -302,8 +316,11 @@ Value ReadObject(const CallbackInfo& args) { throw Error::New(args.Env(), "readObject: Cannot read from nullptr pointer"); } - Reference* rptr = reinterpret_cast*>(ptr); - return rptr->Value(); + ObjectSlot* slot = reinterpret_cast(ptr); + if (slot->magic != kObjectMagic) { + throw Error::New(args.Env(), "readObject: Cannot read Object from uninitialized memory"); + } + return slot->ref.Value(); } /** @@ -324,12 +341,20 @@ void WriteObject(const CallbackInfo& args) { throw Error::New(env, "readObject: Cannot write to nullptr pointer"); } - Reference* rptr = reinterpret_cast*>(ptr); + ObjectSlot* slot = reinterpret_cast(ptr); + if (slot->magic != kObjectMagic) { + // This memory has never been initialized by WriteObject, so its bytes + // cannot be trusted to represent a valid Reference. Construct a + // fresh, empty one in place rather than interpreting the stale bytes. + new (&slot->ref) Reference(); + slot->magic = kObjectMagic; + } + if (args[2].IsObject()) { Object val = args[2].As(); - *rptr = std::move(Reference::New(val)); + slot->ref = std::move(Reference::New(val)); } else if (args[2].IsNull()) { - rptr->Reset(); + slot->ref.Reset(); } else { throw TypeError::New(env, "WriteObject's 3rd argument needs to be an object"); } @@ -674,7 +699,7 @@ Object Init(Env env, Object exports) { SET_SIZEOF(pointer, char *); SET_SIZEOF(size_t, size_t); // size of a weak handle to a JS object - SET_SIZEOF(Object, Reference); + SET_SIZEOF(Object, ObjectSlot); // "alignof" map Object amap = Object::New(env); @@ -704,7 +729,7 @@ Object Init(Env env, Object exports) { SET_ALIGNOF(ulonglong, unsigned long long); SET_ALIGNOF(pointer, char *); SET_ALIGNOF(size_t, size_t); - SET_ALIGNOF(Object, Reference); + SET_ALIGNOF(Object, ObjectSlot); // exports exports["sizeof"] = smap; diff --git a/test/object.js b/test/object.js index 048bde2..bd9c4bc 100644 --- a/test/object.js +++ b/test/object.js @@ -63,6 +63,28 @@ describe('Object', function() { }); }); + it('should throw an Error when reading an Object from uninitialized memory', function() { + // https://github.com/napi-ffi/ref-napi/issues/5 + const buf = Buffer.alloc(64, 1); + assert.throws(() => { + ref.readObject(buf, 0); + }); + }); + + it('should throw an Error when reading an Object from a never-written zero-filled Buffer', function() { + const buf = Buffer.alloc(ref.sizeof.Object); + assert.throws(() => { + ref.readObject(buf, 0); + }); + }); + + it('should write and read back an Object in a Buffer whose memory was previously garbage', function() { + const buf = Buffer.alloc(ref.sizeof.Object, 1); + ref.writeObject(buf, 0, obj); + const out = ref.readObject(buf, 0); + assert.strictEqual(obj, out); + }); + describe('offset', function() { it('should read two Objects next to each other in memory', function() { const buf = Buffer.alloc(ref.sizeof.Object * 2); From 128a18234734a28c09cf9f86f1433b7d0b782e78 Mon Sep 17 00:00:00 2001 From: Gilson Urbano Date: Tue, 28 Jul 2026 15:17:29 +0000 Subject: [PATCH 2/2] Update node-gyp to detect Visual Studio 2026 --- package-lock.json | 249 ++++++++++++++++++++++++++++++++++++++++++++++ package.json | 1 + 2 files changed, 250 insertions(+) diff --git a/package-lock.json b/package-lock.json index cb6d03e..b174ff4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -22,6 +22,7 @@ "jade": "^1.11.0", "marked": "^1.0.0", "mocha": "^7.1.1", + "node-gyp": "^12.4.0", "nyc": "^17.1.0", "prebuildify": "^6.0.1" }, @@ -296,6 +297,19 @@ "node": ">=6.9.0" } }, + "node_modules/@isaacs/fs-minipass": { + "version": "4.0.1", + "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz", + "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==", + "dev": true, + "license": "ISC", + "dependencies": { + "minipass": "^7.0.4" + }, + "engines": { + "node": ">=18.0.0" + } + }, "node_modules/@istanbuljs/load-nyc-config": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz", @@ -466,6 +480,16 @@ "node-gyp-build": "^4.2.1" } }, + "node_modules/abbrev": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-4.0.0.tgz", + "integrity": "sha512-a1wflyaL0tHtJSmLSOVybYhy22vRih4eduhhrkcjgrWGnRfrZtovJ2FRjxuTtkkj47O/baf0R86QU5OuYpz8fA==", + "dev": true, + "license": "ISC", + "engines": { + "node": "^20.17.0 || >=22.9.0" + } + }, "node_modules/acorn": { "version": "2.7.0", "resolved": "https://registry.npmjs.org/acorn/-/acorn-2.7.0.tgz", @@ -1436,6 +1460,16 @@ "dev": true, "license": "BSD-2-Clause" }, + "node_modules/env-paths": { + "version": "2.2.1", + "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz", + "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=6" + } + }, "node_modules/es-abstract": { "version": "1.24.0", "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.0.tgz", @@ -1641,6 +1675,13 @@ "node": ">=4" } }, + "node_modules/exponential-backoff": { + "version": "3.1.3", + "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz", + "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==", + "dev": true, + "license": "Apache-2.0" + }, "node_modules/fill-range": { "version": "7.1.1", "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", @@ -3180,6 +3221,29 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/minipass": { + "version": "7.1.3", + "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz", + "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==", + "dev": true, + "license": "BlueOak-1.0.0", + "engines": { + "node": ">=16 || 14 >=14.17" + } + }, + "node_modules/minizlib": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz", + "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==", + "dev": true, + "license": "MIT", + "dependencies": { + "minipass": "^7.1.2" + }, + "engines": { + "node": ">= 18" + } + }, "node_modules/mkdirp": { "version": "0.5.6", "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz", @@ -3327,6 +3391,31 @@ "semver": "^5.7.0" } }, + "node_modules/node-gyp": { + "version": "12.4.0", + "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-12.4.0.tgz", + "integrity": "sha512-OMcPNvqTCFUnNaBlmdgq+lfNqY7gTiSmNRDjY3uAXRyudeKZEZxu3CLtjMQrx4zZxCX2b/mpNqTtwuCJgXhHkw==", + "dev": true, + "license": "MIT", + "dependencies": { + "env-paths": "^2.2.0", + "exponential-backoff": "^3.1.1", + "graceful-fs": "^4.2.6", + "nopt": "^9.0.0", + "proc-log": "^6.0.0", + "semver": "^7.3.5", + "tar": "^7.5.4", + "tinyglobby": "^0.2.12", + "undici": "^6.25.0", + "which": "^6.0.0" + }, + "bin": { + "node-gyp": "bin/node-gyp.js" + }, + "engines": { + "node": "^20.17.0 || >=22.9.0" + } + }, "node_modules/node-gyp-build": { "version": "4.8.4", "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz", @@ -3338,6 +3427,45 @@ "node-gyp-build-test": "build-test.js" } }, + "node_modules/node-gyp/node_modules/isexe": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz", + "integrity": "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==", + "dev": true, + "license": "BlueOak-1.0.0", + "engines": { + "node": ">=20" + } + }, + "node_modules/node-gyp/node_modules/semver": { + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", + "dev": true, + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/node-gyp/node_modules/which": { + "version": "6.0.1", + "resolved": "https://registry.npmjs.org/which/-/which-6.0.1.tgz", + "integrity": "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg==", + "dev": true, + "license": "ISC", + "dependencies": { + "isexe": "^4.0.0" + }, + "bin": { + "node-which": "bin/which.js" + }, + "engines": { + "node": "^20.17.0 || >=22.9.0" + } + }, "node_modules/node-preload": { "version": "0.2.1", "resolved": "https://registry.npmjs.org/node-preload/-/node-preload-0.2.1.tgz", @@ -3358,6 +3486,22 @@ "dev": true, "license": "MIT" }, + "node_modules/nopt": { + "version": "9.0.0", + "resolved": "https://registry.npmjs.org/nopt/-/nopt-9.0.0.tgz", + "integrity": "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw==", + "dev": true, + "license": "ISC", + "dependencies": { + "abbrev": "^4.0.0" + }, + "bin": { + "nopt": "bin/nopt.js" + }, + "engines": { + "node": "^20.17.0 || >=22.9.0" + } + }, "node_modules/normalize-path": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz", @@ -3971,6 +4115,16 @@ "prebuildify": "bin.js" } }, + "node_modules/proc-log": { + "version": "6.1.0", + "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-6.1.0.tgz", + "integrity": "sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ==", + "dev": true, + "license": "ISC", + "engines": { + "node": "^20.17.0 || >=22.9.0" + } + }, "node_modules/process-on-spawn": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/process-on-spawn/-/process-on-spawn-1.1.0.tgz", @@ -4616,6 +4770,23 @@ "node": ">=6" } }, + "node_modules/tar": { + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/fs-minipass": "^4.0.0", + "chownr": "^3.0.0", + "minipass": "^7.1.2", + "minizlib": "^3.1.0", + "yallist": "^5.0.0" + }, + "engines": { + "node": ">=18" + } + }, "node_modules/tar-fs": { "version": "2.1.4", "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz", @@ -4646,6 +4817,26 @@ "node": ">=6" } }, + "node_modules/tar/node_modules/chownr": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz", + "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==", + "dev": true, + "license": "BlueOak-1.0.0", + "engines": { + "node": ">=18" + } + }, + "node_modules/tar/node_modules/yallist": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz", + "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==", + "dev": true, + "license": "BlueOak-1.0.0", + "engines": { + "node": ">=18" + } + }, "node_modules/test-exclude": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz", @@ -4696,6 +4887,54 @@ "node": "*" } }, + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", + "dev": true, + "license": "MIT", + "dependencies": { + "fdir": "^6.5.0", + "picomatch": "^4.0.4" + }, + "engines": { + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/tinyglobby/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/tinyglobby/node_modules/picomatch": { + "version": "4.0.5", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz", + "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, "node_modules/to-regex-range": { "version": "5.0.1", "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", @@ -4974,6 +5213,16 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/undici": { + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=18.17" + } + }, "node_modules/update-browserslist-db": { "version": "1.1.4", "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.4.tgz", diff --git a/package.json b/package.json index 6ba707c..e1646c6 100644 --- a/package.json +++ b/package.json @@ -52,6 +52,7 @@ "jade": "^1.11.0", "marked": "^1.0.0", "mocha": "^7.1.1", + "node-gyp": "^12.4.0", "nyc": "^17.1.0", "prebuildify": "^6.0.1", "@napi-ffi/weak-napi": "^2.0.2"