From babeb58c5286c55f00e6dfc48c0b609314bcc381 Mon Sep 17 00:00:00 2001
From: Christian Niederer <aqpoba@gmail.com>
Date: Wed, 12 Feb 2020 21:07:10 +0100
Subject: [PATCH] src: add aliased-buffer-overflow abort test

Added native extension similar to
test/addons/stringbytes-external-exceeded-max.
Added an abort test to regression test the non overflow behaviour.

PR-URL: https://github.com/nodejs/node/pull/31740
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: David Carlier <devnexen@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 test/abort/common.gypi                        |  8 ++++++
 .../binding.cc                                | 23 +++++++++++++++
 .../binding.gyp                               |  9 ++++++
 .../test-abort-aliased-buffer-overflow.js     | 28 +++++++++++++++++++
 4 files changed, 68 insertions(+)
 create mode 100644 test/abort/common.gypi
 create mode 100644 test/abort/test_abort-aliased-buffer-overflow/binding.cc
 create mode 100644 test/abort/test_abort-aliased-buffer-overflow/binding.gyp
 create mode 100644 test/abort/test_abort-aliased-buffer-overflow/test-abort-aliased-buffer-overflow.js

diff --git a/test/abort/common.gypi b/test/abort/common.gypi
new file mode 100644
index 00000000000000..19396c61856af3
--- /dev/null
+++ b/test/abort/common.gypi
@@ -0,0 +1,8 @@
+{
+  'defines': [ 'V8_DEPRECATION_WARNINGS=1', 'NODE_WANT_INTERNALS=1' ],
+  'conditions': [
+    [ 'OS in "linux freebsd openbsd solaris android aix cloudabi"', {
+      'cflags': ['-Wno-cast-function-type'],
+    }],
+  ],
+}
diff --git a/test/abort/test_abort-aliased-buffer-overflow/binding.cc b/test/abort/test_abort-aliased-buffer-overflow/binding.cc
new file mode 100644
index 00000000000000..c3bf66061bf0ee
--- /dev/null
+++ b/test/abort/test_abort-aliased-buffer-overflow/binding.cc
@@ -0,0 +1,23 @@
+#include <stdlib.h>
+#include <node.h>
+#include <v8.h>
+
+#include <aliased_buffer.h>
+#include <util-inl.h>
+
+void AllocateAndResizeBuffer(
+  const v8::FunctionCallbackInfo<v8::Value>& args) {
+    v8::Isolate* isolate = args.GetIsolate();
+    int64_t length = args[0].As<v8::BigInt>()->Int64Value();
+
+     node::AliasedBigUint64Array array{isolate, 0};
+
+    array.reserve(length);
+    assert(false);
+  }
+
+void init(v8::Local<v8::Object> exports) {
+  NODE_SET_METHOD(exports,
+                  "allocateAndResizeBuffer",
+                  AllocateAndResizeBuffer);
+}
diff --git a/test/abort/test_abort-aliased-buffer-overflow/binding.gyp b/test/abort/test_abort-aliased-buffer-overflow/binding.gyp
new file mode 100644
index 00000000000000..55fbe7050f18e4
--- /dev/null
+++ b/test/abort/test_abort-aliased-buffer-overflow/binding.gyp
@@ -0,0 +1,9 @@
+{
+  'targets': [
+    {
+      'target_name': 'binding',
+      'sources': [ 'binding.cc' ],
+      'includes': ['../common.gypi'],
+    }
+  ]
+}
diff --git a/test/abort/test_abort-aliased-buffer-overflow/test-abort-aliased-buffer-overflow.js b/test/abort/test_abort-aliased-buffer-overflow/test-abort-aliased-buffer-overflow.js
new file mode 100644
index 00000000000000..33cd21295848b9
--- /dev/null
+++ b/test/abort/test_abort-aliased-buffer-overflow/test-abort-aliased-buffer-overflow.js
@@ -0,0 +1,28 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const cp = require('child_process');
+
+// This test ensures that during resizing of an Aliased*Array the computation
+// of the new size does not overflow.
+
+if (process.argv[2] === 'child') {
+  // test
+  const binding = require(`./build/${common.buildType}/binding`);
+
+  const bigValue = BigInt('0xE000 0000 E000 0000');
+  binding.AllocateAndResizeBuffer(bigValue);
+  assert.fail('this should be unreachable');
+} else {
+  // observer
+  const child = cp.spawn(`${process.execPath}`, [`${__filename}`, 'child']);
+  child.on('exit', common.mustCall(function(code, signal) {
+    if (common.isWindows) {
+      assert.strictEqual(code, 134);
+      assert.strictEqual(signal, null);
+    } else {
+      assert.strictEqual(code, null);
+      assert.strictEqual(signal, 'SIGABRT');
+    }
+  }));
+}