Skip to content

src: fix crash when writing odd-length hex string via Writev#63658

Open
RajeshKumar11 wants to merge 1 commit into
nodejs:mainfrom
RajeshKumar11:fix/stream-hex-odd-length-45150
Open

src: fix crash when writing odd-length hex string via Writev#63658
RajeshKumar11 wants to merge 1 commit into
nodejs:mainfrom
RajeshKumar11:fix/stream-hex-odd-length-45150

Conversation

@RajeshKumar11
Copy link
Copy Markdown
Contributor

Summary

Writing an odd-length hex string to a stream that batches writes via
Writev (e.g. http.request which auto-corks its socket) would
fatal-assert:

node: ../src/string_bytes.cc: Assertion `str->Length() % 2 == 0 &&
"invalid hex string length"' failed.

Reproduction:

const http = require('http');
const req = http.request('http://example.org', { method: 'POST' });
req.write('1', 'hex'); // crashes

Root cause

StringBytes::StorageSize had a CHECK that asserted the hex string
length was even. When writes are batched through Writev, this check
runs before any data is written. A single Write (non-corked path)
did not crash because StringBytes::Write calls HexDecode, which
silently drops the trailing incomplete nibble.

Fix

Remove the CHECK and use integer division for the HEX case, which
naturally rounds down for odd lengths. This is already the behaviour
of StringBytes::Size and HexDecode.

Test

Added test/parallel/test-http-odd-hex-write.js with three cases:

  1. HTTP POST with a single odd-length hex write (was crashing)
  2. HTTP POST with cork/uncork and mixed hex writes (was crashing)
  3. net socket with cork/uncork and an odd-length hex write

Fixes: #45150

@nodejs-github-bot nodejs-github-bot added buffer Issues and PRs related to the buffer subsystem. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels May 30, 2026
@RajeshKumar11 RajeshKumar11 force-pushed the fix/stream-hex-odd-length-45150 branch from fd3d0ec to 6a0c023 Compare May 30, 2026 07:51
@codecov
Copy link
Copy Markdown

codecov Bot commented May 30, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.34%. Comparing base (30a7e28) to head (0e3192c).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #63658      +/-   ##
==========================================
- Coverage   91.95%   90.34%   -1.61%     
==========================================
  Files         379      732     +353     
  Lines      166454   236434   +69980     
  Branches    25427    44532   +19105     
==========================================
+ Hits       153058   213614   +60556     
- Misses      13104    14522    +1418     
- Partials      292     8298    +8006     
Files with missing lines Coverage Δ
src/string_bytes.cc 71.54% <ø> (ø)

... and 482 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@RajeshKumar11 RajeshKumar11 force-pushed the fix/stream-hex-odd-length-45150 branch from 6a0c023 to 84ef8a0 Compare May 30, 2026 11:13
StringBytes::StorageSize had a CHECK that fatal-asserted when a
hex-encoded string with an odd number of characters was written
through Writev (e.g. via HTTP requests which are automatically
corked). Writing the same string via a single Write did not crash
because StringBytes::Write delegates to HexDecode, which silently
drops the trailing incomplete nibble.

Remove the CHECK and let integer division handle odd lengths, which
is consistent with StringBytes::Size and HexDecode.

Fixes: nodejs#45150
Signed-off-by: RajeshKumar11 <kakumanurajeshkumar@gmail.com>
@RajeshKumar11 RajeshKumar11 force-pushed the fix/stream-hex-odd-length-45150 branch from 84ef8a0 to 0e3192c Compare May 30, 2026 11:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

buffer Issues and PRs related to the buffer subsystem. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash if wrong hex string is written to http.ClientRequest

2 participants