-
-
Notifications
You must be signed in to change notification settings - Fork 35.3k
fs.stat crash program on invalid string #55914
Copy link
Copy link
Closed
libuv/libuv
#4609Labels
libuvIssues and PRs related to the libuv dependency or the uv binding.Issues and PRs related to the libuv dependency or the uv binding.windowsIssues and PRs related to the Windows platform.Issues and PRs related to the Windows platform.
Metadata
Metadata
Assignees
Labels
libuvIssues and PRs related to the libuv dependency or the uv binding.Issues and PRs related to the libuv dependency or the uv binding.windowsIssues and PRs related to the Windows platform.Issues and PRs related to the Windows platform.
Version
v22.2.0
Platform
Subsystem
No response
What steps will reproduce the bug?
This will crash the entire program not even recoverable with a
trystatementlogs:
How often does it reproduce? Is there a required condition?
I think this might be windows only based on the libuv source
What is the expected behavior? Why is that the expected behavior?
Throw an error/call the actual callback with the error.
What do you see instead?
The entire program crashes
Additional information
I discovered this by performing a fuzz test on my remix.js site which uses express.js which uses fs.stat.
This can take down a production server no matter their routes with just a HTTP GET request as long as they have express.static or similar behaviour for static file serving.
See remix-run/remix#10241