Skip to content

zlib: strictly validate Zstd pledgedSrcSize#64604

Open
Archkon wants to merge 1 commit into
nodejs:mainfrom
Archkon:zlib3
Open

zlib: strictly validate Zstd pledgedSrcSize#64604
Archkon wants to merge 1 commit into
nodejs:mainfrom
Archkon:zlib3

Conversation

@Archkon

@Archkon Archkon commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Fixes: #64603

@nodejs-github-bot

nodejs-github-bot commented Jul 19, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/streams

@Archkon
Archkon marked this pull request as draft July 19, 2026 16:18
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. stream Issues and PRs related to the stream subsystem. zlib Issues and PRs related to the zlib subsystem. labels Jul 19, 2026
@codecov

codecov Bot commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 50.00000% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.11%. Comparing base (00917ba) to head (0f3759e).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
src/node_zlib.cc 16.66% 7 Missing and 3 partials ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #64604      +/-   ##
==========================================
- Coverage   90.14%   90.11%   -0.04%     
==========================================
  Files         741      741              
  Lines      242076   242077       +1     
  Branches    45558    45543      -15     
==========================================
- Hits       218216   218140      -76     
- Misses      15385    15437      +52     
- Partials     8475     8500      +25
Files with missing lines Coverage Δ
lib/internal/streams/iter/transform.js 95.75% <100.00%> (-0.04%) ⬇️
lib/zlib.js 98.34% <100.00%> (+<0.01%) ⬆️
src/node_zlib.cc 77.84% <16.66%> (-0.66%) ⬇️

... and 31 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Archkon
Archkon marked this pull request as ready for review July 20, 2026 04:50
@Archkon Archkon mentioned this pull request Jul 20, 2026
Open
@Archkon
zlib: validate pledgedSrcSize as a safe integer
0f3759e 
pledgedSrcSize represents an exact byte count. Reject values that are
not non-negative safe integers instead of silently ignoring or coercing
them through IntegerValue().

Apply the same validation to zlib/iter and retain a native validation
check for internal callers.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon

Archkon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@hybrist @jasnell Could you take look at this? Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. stream Issues and PRs related to the stream subsystem. zlib Issues and PRs related to the zlib subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

zlib: strictly validate Zstd pledgedSrcSize

2 participants

@Archkon @nodejs-github-bot