Conversation
|
All contributors have signed the CLA ✍️ ✅ |
There was a problem hiding this comment.
Overall this is a solid set of fixes for resizable ArrayBuffer handling. The temp-buffer approach in the BYOB read path correctly prevents SIGSEGV from decommitted pages, and eagerly copying data on the write path eliminates TOCTOU races with resizable/shared buffers. Two minor items:
- Dead code in
buffer.c++(inline comment below). src/workerd/api/streams/README.mdline 425 still shows the oldWritestruct pattern withjsg::V8Ref<v8::ArrayBuffer> ownBytes— worth updating tokj::Array<kj::byte> ownBytesto match the new implementation.
| // (which reflects the re-validated live size) for copy bounds. | ||
|
|
||
| auto ptr = src.asArrayPtr(); | ||
| if (src.size() == 0) continue; |
There was a problem hiding this comment.
This check is dead code: since effectiveSize = kj::min(src.size(), ...), effectiveSize > 0 (which passed line 255) implies src.size() > 0. Consider removing it to avoid confusing future readers.
| if (src.size() == 0) continue; |
|
I'm Bonk, and I've done a quick review of your PR. Summary: Multiple fixes for resizable ArrayBuffer handling — temp-buffer reads for BYOB to prevent SIGSEGV, eager data copying on writes to eliminate TOCTOU with resizable/shared buffers, and bounds-clamping in Issues found (ranked by severity):
|
|
@AlbertSPedersen can I ask you to acknowledge the CLA here in a comment please |
|
I have read the CLA Document and I hereby sign the CLA |
When a BYOB read is pending and the underlying resizable ArrayBuffer is resized, the destination pointer may reference decommitted virtual memory, causing a SIGSEGV in the memcpy inside tryRead. For resizable buffers, allocate a temporary heap buffer for the read and copy the data back into the user's buffer in the .then() callback after validating it is still large enough. Also add pre-read validation to return a zero-length view when byteOffset already exceeds the current ByteLength. Signed-off-by: James M Snell <jsnell@cloudflare.com>
Signed-off-by: James M Snell <jsnell@cloudflare.com>
Signed-off-by: James M Snell <jsnell@cloudflare.com>
25d0407 to
46d1bea
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #6214 +/- ##
==========================================
- Coverage 70.60% 70.58% -0.03%
==========================================
Files 413 413
Lines 109994 110034 +40
Branches 18121 18129 +8
==========================================
+ Hits 77660 77666 +6
- Misses 21527 21554 +27
- Partials 10807 10814 +7 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Multiple improvements to resizable ArrayBuffer handling