src: fix OOB reads in process.title getter
The getter passed a stack-allocated, fixed-size buffer to uv_get_process_title() but neglected to check the return value. When the total length of the command line arguments exceeds the size of the buffer, libuv returns UV_ENOBUFS and doesn't modify the contents of the buffer. The getter then proceeded to return whatever garbage was on the stack at the time of the call, quite possibly reading beyond the end of the buffer. Add a GetProcessTitle() helper that reads the process title into a dynamically allocated buffer that is resized when necessary. Fixes: https://github.com/nodejs/node/issues/31631 PR-URL: https://github.com/nodejs/node/pull/31633 Reviewed-By:James M Snell <jasnell@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
David Carlier <devnexen@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com>
parent
7df42980
Please register or sign in to comment