Skip to content

ffi: optimized fast pointer BigInts bypass range validation #65031

Description

@trivikr

Version

main

Platform

macOS 26.6.0

Subsystem

ffi

What steps will reproduce the bug?

repro.c

__attribute__((visibility("default")))
void* identity_pointer(void* ptr) {
  return ptr;
}

repro.js

import { dlopen } from 'node:ffi';

const { lib, functions } = dlopen('./repro.dylib', {
  identity_pointer: { arguments: ['pointer'], return: 'pointer' },
});

const identityPointer = functions.identity_pointer;

function show(label, fn) {
  try {
    console.log(`${label}:`, String(fn()));
  } catch (err) {
    console.log(`${label}:`, err.code || err.name);
  }
}

show('cold -1n', () => identityPointer(-1n));

%PrepareFunctionForOptimization(identityPointer);
identityPointer(0n);
identityPointer(0n);
%OptimizeFunctionOnNextCall(identityPointer);
identityPointer(0n);

show('optimized -1n', () => identityPointer(-1n));
show('optimized 2^64+5', () => identityPointer((1n << 64n) + 5n));

lib.close();

Run

$ cc -dynamiclib -o repro.dylib repro.c

$ node --no-warnings --experimental-ffi --allow-natives-syntax repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

cold -1n: ERR_INVALID_ARG_VALUE
optimized -1n: ERR_INVALID_ARG_VALUE
optimized 2^64+5: ERR_INVALID_ARG_VALUE

Optimized fast calls to match generic and shared-buffer validation and throw ERR_INVALID_ARG_VALUE.

What do you see instead?

cold -1n: ERR_INVALID_ARG_VALUE
optimized -1n: 18446744073709551615
optimized 2^64+5: 5

cold -1n throws, but after optimizing the FFI wrapper -1n is passed as 2^64 - 1 and 2^64 + 5 is passed as 5

Additional information

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

ffiIssues and PRs related to experimental Foreign Function Interface support.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions