Skip to content

Commit d5a5280

Browse files
mcollinaaduh95
authored andcommitted
zlib: handle params callback after destroy
When params() queues its flush behind another write, destroying the stream invokes the flush callback after the native handle is closed. Propagate the write error instead of accessing the closed handle. Assisted-by: Codex Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs-private/node-private#1037 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> CVE-ID: CVE-2026-123862
1 parent be2898b commit d5a5280

2 files changed

Lines changed: 20 additions & 8 deletions

File tree

‎lib/zlib.js‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -789,14 +789,16 @@ const zlibDefaultOpts = {
789789
// before adjusting the parameters. In particular, the call to the native
790790
// `params()` function should not happen while a write is currently in progress
791791
// on the threadpool.
792-
function paramsAfterFlushCallback(level, strategy, callback) {
793-
assert(this._handle, 'zlib binding closed');
794-
this._handle.params(level, strategy);
795-
if (!this.destroyed) {
796-
this._level = level;
797-
this._strategy = strategy;
798-
if (callback) callback();
792+
function paramsAfterFlushCallback(level, strategy, callback, err) {
793+
if (err || this.destroyed || !this._handle) {
794+
if (callback) callback(err);
795+
return;
799796
}
797+
798+
this._handle.params(level, strategy);
799+
this._level = level;
800+
this._strategy = strategy;
801+
if (callback) callback();
800802
}
801803

802804
// Base class for all streams actually backed by zlib and using zlib-specific

‎test/parallel/test-zlib-params.js‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
'use strict';
2-
require('../common');
2+
const common = require('../common');
33
const assert = require('assert');
44
const zlib = require('zlib');
55
const fixtures = require('../common/fixtures');
@@ -38,3 +38,13 @@ process.once('exit', function() {
3838
const actual = Buffer.concat(bufs);
3939
assert.deepStrictEqual(actual, expected);
4040
});
41+
42+
{
43+
const deflater = zlib.createDeflate();
44+
deflater.write('x');
45+
deflater.params(9, zlib.constants.Z_DEFAULT_STRATEGY,
46+
common.mustCall((err) => {
47+
assert.strictEqual(err.code, 'ERR_STREAM_DESTROYED');
48+
}));
49+
deflater.destroy();
50+
}

0 commit comments

Comments
 (0)