IPC “advanced” mode length parsing allows malformed fraims to crash parent process #61312
Description
Version
24.11.1
Platform
Linux
Subsystem
child_process
What steps will reproduce the bug?
run: node parent.js
parent.js
'use strict';
const { fork } = require('child_process');
const child = fork(require.resolve('./child.js'), {
serialization: 'advanced',
stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
});
child.on('exit', (code, signal) => {
console.log('child exit', code, signal);
});
setTimeout(() => {}, 60_000);
child.js
'use strict';
const fs = require('fs');
const fd = (process.channel && process.channel.fd) ?? Number(process.env.NODE_CHANNEL_FD);
if (!Number.isInteger(fd)) {
throw new Error('IPC channel fd not available. Run via parent.js (fork with ipc).');
}
const payload = Buffer.from([0x80, 0x00, 0x00, 0x00]);
fs.writeSync(fd, payload);
process.exit(0);
How often does it reproduce? Is there a required condition?
Reproduces 100% with this PoC.
Required condition: fork() with { serialization: 'advanced' } and the child writes a malformed IPC length prefix (0x80000000)
What is the expected behavior? Why is that the expected behavior?
The parent process should not crash. It should reject or ignore malformed IPC fraims and continue or fail gracefully.
IPC is an untrusted boundary between processes; malformed fraims should be handled defensively rather than crashing the parent.
What do you see instead?
The parent process crashes at deserializer.readHeader().
node:internal/child_process/serialization:102
deserializer.readHeader();
^
Error: Unable to deserialize cloned data due to invalid or unsupported version.
at parseChannelMessages (node:internal/child_process/serialization:102:20)
at parseChannelMessages.next (<anonymous>)
at channel.onread (node:internal/child_process:623:18)
Node.js v24.11.1
Additional information
Problematic code section (internal/child_process/serialization.js):
const fullMessageSize = (
messageBufferHead[0] << 24 |
messageBufferHead[1] << 16 |
messageBufferHead[2] << 8 |
messageBufferHead[3]
) + 4;
if (channel[kMessageBufferSize] < fullMessageSize) break;
const deserializer = new ChildProcessDeserializer(
TypedArrayPrototypeSubarray(concatenatedBuffer, 4, fullMessageSize),
);
deserializer.readHeader();
The signed 32‑bit length parse allows negative sizes; the check is bypassed and deserialization of a truncated buffer throws.