string_decoder: fix crash when calling __proto__.write()

This makes the function throw an exception from JS instead of crashing. Fixes: nodejs#41949 Signed-off-by: Darshan Sen <[email protected]>
RaisinTen · Feb 20, 2022 · abb6183 · abb6183
1 parent dde2f78
commit abb6183
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/lib/string_decoder.js b/lib/string_decoder.js
@@ -42,6 +42,7 @@ const {
 } = internalBinding('string_decoder');
 const internalUtil = require('internal/util');
 const {
+  ERR_ILLEGAL_CONSTRUCTOR,
   ERR_INVALID_ARG_TYPE,
   ERR_UNKNOWN_ENCODING
 } = require('internal/errors').codes;
@@ -101,6 +102,9 @@ StringDecoder.prototype.write = function write(buf) {
     throw new ERR_INVALID_ARG_TYPE('buf',
                                    ['Buffer', 'TypedArray', 'DataView'],
                                    buf);
+  if (!this[kNativeDecoder]) {
+    throw new ERR_ILLEGAL_CONSTRUCTOR();
+  }
   return decode(this[kNativeDecoder], buf);
 };
 

diff --git a/test/parallel/test-string-decoder.js b/test/parallel/test-string-decoder.js
@@ -210,6 +210,13 @@ if (common.enoughTestMem) {
   );
 }
 
+assert.throws(
+  () => new StringDecoder('utf8').__proto__.write(Buffer.from('abc')), // eslint-disable-line no-proto
+  {
+    code: 'ERR_ILLEGAL_CONSTRUCTOR',
+  }
+);
+
 // Test verifies that StringDecoder will correctly decode the given input
 // buffer with the given encoding to the expected output. It will attempt all
 // possible ways to write() the input buffer, see writeSequences(). The