zlib: pause stream if outgoing buffer is full

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs-private/node-private#540
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Ref: https://hackerone.com/reports/2284065
PR-URL: nodejs-private/node-private#542
CVE-ID: CVE-2024-22025

Author: mcollina

lib/zlib.js

@@ -560,10 +560,11 @@ function processCallback() {
   self.bytesWritten += inDelta;
 
   const have = handle.availOutBefore - availOutAfter;
+  let streamBufferIsFull = false;
   if (have > 0) {
     const out = self._outBuffer.slice(self._outOffset, self._outOffset + have);
     self._outOffset += have;
-    self.push(out);
+    streamBufferIsFull = !self.push(out);
   } else {
     assert(have === 0, 'have should not go down');
   }
@@ -588,13 +589,29 @@ function processCallback() {
     handle.inOff += inDelta;
     handle.availInBefore = availInAfter;
 
-    this.write(handle.flushFlag,
-               this.buffer, // in
-               handle.inOff, // in_off
-               handle.availInBefore, // in_len
-               self._outBuffer, // out
-               self._outOffset, // out_off
-               self._chunkSize); // out_len
+
+    if (!streamBufferIsFull) {
+      this.write(handle.flushFlag,
+                 this.buffer, // in
+                 handle.inOff, // in_off
+                 handle.availInBefore, // in_len
+                 self._outBuffer, // out
+                 self._outOffset, // out_off
+                 self._chunkSize); // out_len
+    } else {
+      const oldRead = self._read;
+      self._read = (n) => {
+        self._read = oldRead;
+        this.write(handle.flushFlag,
+                   this.buffer, // in
+                   handle.inOff, // in_off
+                   handle.availInBefore, // in_len
+                   self._outBuffer, // out
+                   self._outOffset, // out_off
+                   self._chunkSize); // out_len
+        self._read(n);
+      };
+    }
     return;
   }
 

test/parallel/test-zlib-brotli-16GB.js

@@ -12,23 +12,29 @@ const deflater = zlib.createDeflate(opts);
 const chunk1 = file.slice(0, chunkSize);
 const chunk2 = file.slice(chunkSize);
 const blkhdr = Buffer.from([0x00, 0x5a, 0x82, 0xa5, 0x7d]);
-const expected = Buffer.concat([blkhdr, chunk2]);
-let actual;
+const blkftr = Buffer.from('010000ffff7dac3072', 'hex');
+const expected = Buffer.concat([blkhdr, chunk2, blkftr]);
+const bufs = [];
+
+function read() {
+  let buf;
+  while ((buf = deflater.read()) !== null) {
+    bufs.push(buf);
+  }
+}
 
 deflater.write(chunk1, function() {
   deflater.params(0, zlib.constants.Z_DEFAULT_STRATEGY, function() {
     while (deflater.read());
-    deflater.end(chunk2, function() {
-      const bufs = [];
-      let buf;
-      while ((buf = deflater.read()) !== null)
-        bufs.push(buf);
-      actual = Buffer.concat(bufs);
-    });
+
+    deflater.on('readable', read);
+
+    deflater.end(chunk2);
   });
   while (deflater.read());
 });
 
 process.once('exit', function() {
+  const actual = Buffer.concat(bufs);
   assert.deepStrictEqual(actual, expected);
 });