Repository navigation
SIGSEGV when reading object before write #5
Description
'use strict';
const ref = require("./build/Release/binding.node");
const buf = Buffer.alloc(64, 1);
ref.readObject(buf, 0);leads to
segmentation fault (core dumped) node repro.js
The problem is that the buffer contents are interpreted as references to object heaps before writing any reference to an object into the buffer.
Activity
urbanogilson commentedon Jul 28, 2026
@theosotr thanks for the clear repro, confirmed and root-caused this.
readObject/writeObjectreinterpret the rawBuffermemory directly as aNapi::Reference<Object>(a real C++ object with{env, ref, suppressDestruct}fields), with no check that the bytes at that address actually hold a previously-written reference. SinceBuffer.alloc(64, 1)fills the memory with0x01bytes, the reinterpretedreffield becomes a bogus non-null "handle," and N-API tries to dereference it, crashing the whole process instead of failing safely. (Zero-filled buffers happened to work by accident, since a null handle short-circuits before touching invalid memory, but nothing actually enforced that requirement.)urbanogilson commentedon Jul 28, 2026
I'll tag the memory with a magic marker written by
writeObjecton first use.readObjectnow checks for that marker and throws a normal, catchableError("Cannot read Object from uninitialized memory") when it's absent, instead of dereferencing untrusted bytes.writeObjecton unmarked memory now safely bootstraps a fresh reference in place rather than assuming the existing bytes are valid.Fix SIGSEGV when reading an Object before it's been written (#5) (#6)