Repository navigation
ffi: optimized fast pointer BigInts bypass range validation #65031
Description
Version
main
Platform
macOS 26.6.0
Subsystem
ffi
What steps will reproduce the bug?
repro.c
__attribute__((visibility("default")))
void* identity_pointer(void* ptr) {
return ptr;
}repro.js
import { dlopen } from 'node:ffi';
const { lib, functions } = dlopen('./repro.dylib', {
identity_pointer: { arguments: ['pointer'], return: 'pointer' },
});
const identityPointer = functions.identity_pointer;
function show(label, fn) {
try {
console.log(`${label}:`, String(fn()));
} catch (err) {
console.log(`${label}:`, err.code || err.name);
}
}
show('cold -1n', () => identityPointer(-1n));
%PrepareFunctionForOptimization(identityPointer);
identityPointer(0n);
identityPointer(0n);
%OptimizeFunctionOnNextCall(identityPointer);
identityPointer(0n);
show('optimized -1n', () => identityPointer(-1n));
show('optimized 2^64+5', () => identityPointer((1n << 64n) + 5n));
lib.close();Run
$ cc -dynamiclib -o repro.dylib repro.c
$ node --no-warnings --experimental-ffi --allow-natives-syntax repro.jsHow often does it reproduce? Is there a required condition?
Always
What is the expected behavior? Why is that the expected behavior?
cold -1n: ERR_INVALID_ARG_VALUE
optimized -1n: ERR_INVALID_ARG_VALUE
optimized 2^64+5: ERR_INVALID_ARG_VALUEOptimized fast calls to match generic and shared-buffer validation and throw ERR_INVALID_ARG_VALUE.
What do you see instead?
cold -1n: ERR_INVALID_ARG_VALUE
optimized -1n: 18446744073709551615
optimized 2^64+5: 5cold -1n throws, but after optimizing the FFI wrapper -1n is passed as 2^64 - 1 and 2^64 + 5 is passed as 5
Additional information
No response
Activity
ffi: validate fast pointer BigInt argument ranges
ffi: validate fast pointer BigInt argument ranges
ffi: validate fast pointer BigInt argument ranges