node-addon-api 1.7.1 → 1.7.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # node-addon-api Changelog
 
+## 2020-06-02 Version 1.7.2, @NickNaso
+
+### Notable changes:
+
+#### API
+
+- Fix memory corruption vulnerability
+
+### Commmits
+
+* [[`801bd068f4`](https://github.com/nodejs/node-addon-api/commit/801bd068f4)] - **napi**: fix memory corruption vulnerability (Tobias Nießen )
+
 ## 2019-07-23 Version 1.7.1, @NickNaso
 
 ### Notable changes:

package/README.md

@@ -46,7 +46,7 @@ to ideas specified in the **ECMA262 Language Specification**.
 - **[Contributors](#contributors)**
 - **[License](#license)**
 
-## **Current version: 1.7.1**
+## **Current version: 1.7.2**
 
 (See [CHANGELOG.md](CHANGELOG.md) for complete Changelog)
 

package/package.json

@@ -45,6 +45,7 @@
     "Sam Roberts (https://github.com/sam-github)",
     "Taylor Woll (https://github.com/boingoing)",
     "Thomas Gentilhomme (https://github.com/fraxken)",
+    "Tobias Nießen (https://github.com/tniessen)",
     "Tux3 (https://github.com/tux3)",
     "Yohei Kishimoto (https://github.com/morokosi)"
   ],
@@ -74,5 +75,5 @@
     "dev:incremental": "node test",
     "doc": "doxygen doc/Doxyfile"
   },
-  "version": "1.7.1"
+  "version": "1.7.2"
 }

package/src/node_api.cc

@@ -2238,7 +2238,7 @@ napi_status napi_get_value_string_latin1(napi_env env,
   if (!buf) {
     CHECK_ARG(env, result);
     *result = val.As<v8::String>()->Length();
-  } else {
+  } else if (bufsize != 0) {
     int copied = val.As<v8::String>()->WriteOneByte(
       reinterpret_cast<uint8_t*>(buf), 0, bufsize - 1,
       v8::String::NO_NULL_TERMINATION);
@@ -2247,6 +2247,8 @@ napi_status napi_get_value_string_latin1(napi_env env,
     if (result != nullptr) {
       *result = copied;
     }
+  } else if (result != nullptr) {
+    *result = 0;
   }
 
   return napi_clear_last_error(env);
@@ -2274,7 +2276,7 @@ napi_status napi_get_value_string_utf8(napi_env env,
   if (!buf) {
     CHECK_ARG(env, result);
     *result = val.As<v8::String>()->Utf8Length();
-  } else {
+  } else if (bufsize != 0) {
     int copied = val.As<v8::String>()->WriteUtf8(
       buf, bufsize - 1, nullptr, v8::String::REPLACE_INVALID_UTF8 |
       v8::String::NO_NULL_TERMINATION);
@@ -2283,6 +2285,8 @@ napi_status napi_get_value_string_utf8(napi_env env,
     if (result != nullptr) {
       *result = copied;
     }
+  } else if (result != nullptr) {
+    *result = 0;
   }
 
   return napi_clear_last_error(env);
@@ -2311,7 +2315,7 @@ napi_status napi_get_value_string_utf16(napi_env env,
     CHECK_ARG(env, result);
     // V8 assumes UTF-16 length is the same as the number of characters.
     *result = val.As<v8::String>()->Length();
-  } else {
+  } else if (bufsize != 0) {
     int copied = val.As<v8::String>()->Write(
       reinterpret_cast<uint16_t*>(buf), 0, bufsize - 1,
       v8::String::NO_NULL_TERMINATION);
@@ -2320,6 +2324,8 @@ napi_status napi_get_value_string_utf16(napi_env env,
     if (result != nullptr) {
       *result = copied;
     }
+  } else if (result != nullptr) {
+    *result = 0;
   }
 
   return napi_clear_last_error(env);