From 00a3a05da8b91dd83fa7b8f764b9325ffad84c09 Mon Sep 17 00:00:00 2001 From: shadowmystical3-ai Date: Tue, 10 Mar 2026 17:26:48 +0000 Subject: [PATCH] Fix critical buffer overflow vulnerability in fromBigInt function - Fixes CVE security issue: Buffer overflow in bigint-buffer native module - Problem: The stack allocation check only validated word count (word_width_bytes) but the actual memset/malloc used byte_width + overflow_len, causing overflow when large numbers were converted with non-64-bit alignment - Solution: Changed the stack-fit check to validate the actual allocation size (buffer_size = byte_width + overflow_len) before deciding between stack and heap - Impact: Prevents potential crash/exploit attacks when processing large BigInt values with non-aligned word widths - Testing: All existing tests pass with compiled native module --- src/bigint-buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bigint-buffer.c b/src/bigint-buffer.c index e57d516..d734789 100644 --- a/src/bigint-buffer.c +++ b/src/bigint-buffer.c @@ -149,8 +149,8 @@ napi_value fromBigInt (napi_env env, napi_callback_info info) { if (word_count > word_width) { word_count = word_width; } - size_t word_width_bytes = (word_count << 3); - bool fits_in_stack = word_width_bytes <= BUFFER_STACK_SIZE; + size_t buffer_size = byte_width + overflow_len; + bool fits_in_stack = buffer_size <= BUFFER_STACK_SIZE; uint64_t* conv_buffer = (uint64_t*) raw_buffer; uint64_t stack_buffer[BUFFER_STACK_SIZE];