Compare commits

...

1 Commits

Author SHA1 Message Date
Claude
7286f9d6d6 fix(socket): validate argument type in Listener.getsockname()
`Listener.getsockname()` expects an object argument to populate with
address info, but did not validate the argument type before calling
`.put()` on it. When called with a non-object argument (e.g. a number),
`JSValue::getObject()` returns null, causing a null pointer dereference
in `JSC__JSValue__putBunString`.

Add an `isObject()` check and throw a TypeError if the argument is not
an object.

Reproduction:
```js
const v9 = { data: function(a7, a8) { return WeakSet; } };
const v11 = Bun.listen({ hostname: "localhost", port: 0, socket: v9 });
v11.getsockname(0);
```
2026-02-20 22:29:55 +00:00

View File

@@ -851,6 +851,9 @@ pub fn getsockname(this: *Listener, globalThis: *jsc.JSGlobalObject, callFrame:
}
const out = callFrame.argumentsAsArray(1)[0];
if (!out.isObject()) {
return globalThis.throwInvalidArguments("Expected object", .{});
}
const socket = this.listener.uws;
var buf: [64]u8 = [_]u8{0} ** 64;