zlib: add internal assertion on stream transform

nodejs · Dec 25, 2024 · 07f3de0 · 07f3de0
1 parent 3147ec2
commit 07f3de0
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/lib/zlib.js b/lib/zlib.js
@@ -40,6 +40,7 @@ const {
   codes: {
     ERR_BROTLI_INVALID_PARAM,
     ERR_BUFFER_TOO_LARGE,
+    ERR_INTERNAL_ASSERTION,
     ERR_INVALID_ARG_TYPE,
     ERR_OUT_OF_RANGE,
   },
@@ -353,6 +354,9 @@ ZlibBase.prototype._destroy = function(err, callback) {
 };
 
 ZlibBase.prototype._transform = function(chunk, encoding, cb) {
+  if (!Buffer.isBuffer(chunk)) {
+    throw new ERR_INTERNAL_ASSERTION('Chunk must be a Buffer');
+  }
   let flushFlag = this._defaultFlushFlag;
   // We use a 'fake' zero-length chunk to carry information about flushes from
   // the public API to the actual stream implementation.

diff --git a/test/parallel/test-zlib.js b/test/parallel/test-zlib.js
@@ -238,3 +238,15 @@ testKeys.forEach(common.mustCall((file) => {
   const gzip = zlib.Gzip();
   assert.ok(gzip instanceof zlib.Gzip);
 }
+
+{
+  // Misuse of stream internals
+  // Issue: https://github.com/nodejs/node/issues/37884
+  assert.throws(() => zlib.createGunzip()._transform('Hello'), {
+    code: 'ERR_INTERNAL_ASSERTION',
+  });
+
+  assert.throws(() => zlib.createGunzip()._write('Hello'), {
+    code: 'ERR_INTERNAL_ASSERTION',
+  });
+}