nodejs / nodejs/nan

I'm seeing calls to HandleProgressCallback with NULL as the pointer AsyncProgressWorker

Open
#795 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
3.4k
Forks
531
Avg merge
21m
Merged PRs (30d)
1

Description

I noticed that at this line it is possible for HandleProgressCallback to be called with NULL, if coming into this function asyncdata_ == NULL then it will be copied to data, and then passed into HandleProgressCallback() (the delete[] data a few lines later will pass (if it gets there, but I got an access violation before that happened :-( ).

I caught this in VS 2015 debugger by setting a conditional breakpoint where data == null

I've added some protective code in my HandleProgressCallback, but thought you might want to consider guarding against it in WorkProgress(), I think (not 100% sure) it happens just before HandleOKCallback() would be called.

Here's my HandleProgressCallback() for reference

void StlWorker::HandleProgressCallback(const char *data, size_t size) {
    Nan::HandleScope scope;

    if (m_progress && data) { // Need to check data for non-NULL (which we can be called with)
        int progress = *reinterpret_cast<int*>(const_cast<char*>(data));

        v8::Local<v8::Value> argv[] = {
            New<v8::Integer>(progress)
        };

        m_progress->Call(1, argv);
    }
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review nan.h around line 2032 and trace WorkProgress into HandleProgressCallback, focusing on how asyncdata_ becomes data before the callback. Use the reported VS 2015 conditional breakpoint to confirm the null case and compare it with the point where HandleOKCallback() is reached. Done means the null-pointer path is handled consistently and the behavior is covered or clearly verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, node.js
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.