From a702884060aedd20a0f3bbf273b71b97c154c5c2 Mon Sep 17 00:00:00 2001 From: frandle331-yh Date: Mon, 27 Jul 2026 10:31:06 +0900 Subject: [PATCH] fs: fix out-of-bounds write in mkdtemp for long prefixes Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`, leaving no room for the terminating NUL byte. For a single-byte prefix long enough to force the heap allocation path (length + 6 > the stack-buffer threshold), the terminating NUL was written one byte past the end of the buffer -- a 1-byte heap-buffer-overflow flagged by AddressSanitizer. Allocate room for the terminating NUL, copy the suffix, and use SetLengthAndZeroTerminate to set the correct length and write the terminator, following the MaybeStackBuffer paradigm used elsewhere in this file. Signed-off-by: frandle331-yh --- src/node_file.cc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/node_file.cc b/src/node_file.cc index 78bb84b9f06c11..cf3881c74f5084 100644 --- a/src/node_file.cc +++ b/src/node_file.cc @@ -3364,10 +3364,11 @@ static void Mkdtemp(const FunctionCallbackInfo& args) { CHECK_GE(argc, 2); BufferValue tmpl(isolate, args[0]); - static constexpr const char* const suffix = "XXXXXX"; - const auto length = tmpl.length(); - tmpl.AllocateSufficientStorage(length + strlen(suffix)); - snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix); + const auto prefix_length = tmpl.length(); + static constexpr std::string_view suffix = "XXXXXX"; + tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1); + memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size()); + tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size()); CHECK_NOT_NULL(*tmpl);