nodejs/uvwasi

uvwasi accepts malformed path containing null byte

yagehu opened this issue · 0 comments

Calling path_open in uvwasi with a path that contains null byte does not error. Here's an example:

fn main() {
    unsafe {
        let bytes = [18u8, 110u8, 0];
        let path = String::from_utf8(bytes.to_vec()).unwrap();
        let fd = wasi::path_open(
            3,
            0,
            &path,
            wasi::OFLAGS_CREAT | wasi::OFLAGS_EXCL | wasi::OFLAGS_TRUNC,
            wasi::RIGHTS_FD_READ | wasi::RIGHTS_FD_WRITE | wasi::RIGHTS_FD_SEEK,
            0,
            wasi::FDFLAGS_APPEND | wasi::FDFLAGS_NONBLOCK,
        )
        .unwrap();

        eprintln!("fd: {errno}");
    }
}

This Rust example depends on wasi crate v0.11.

On other runtimes, this example fails with inval. But Node succeeds, creating a file with a 2-byte filename.