fix: copy lazy unpack input so transferred buffers cannot dangle

- Copy the caller Buffer before msgpack_unpack_next when lazy is set
- str/bin aliases session-owned bytes, not the transferable backing store
- Add a transfer test for str and bin after structuredClone detach

Author: enochgroot

CHANGELOG.md

@@ -23,6 +23,9 @@ as accessors so nested values are not converted until they are read. See `#40`.
   lazy value also round-trips because it calls `toJSON`.
 - Primitives, incomplete buffers, trailing `bytes_remaining`, and the DoS
   limits are unchanged. `__proto__` / `constructor` stay own properties.
+- Lazy unpack copies the input before decode so str/bin do not alias the
+  caller's Buffer. Transferring that Buffer after unpack cannot dangle
+  later property reads.
 
 ## [3.1.0] - 2026-09-19
 

COVERAGE.md

@@ -150,9 +150,10 @@ gcovr --root . --filter src/ --exclude deps/ --no-markers --txt-metric branch --
   identity, nested `o.c[1]` without reading siblings, `__proto__` /
   `constructor` as own properties, oversized headers still throw, incomplete
   buffers still return `null`, `toJSON` / `JSON.stringify` / `util.inspect`
-  match eager unpack, nested BigInt, non-object second args, and toJSON
-  `this` checks. Lazy OOM / empty-Maybe / ObjectTemplate-failure arms are
-  marked `GCOVR_EXCL_*`, not deleted.
+  match eager unpack, nested BigInt, non-object second args, toJSON
+  `this` checks, and str/bin reads after the caller Buffer is transferred.
+  Lazy OOM / empty-Maybe / ObjectTemplate-failure / CopyBuffer-failure arms
+  are marked `GCOVR_EXCL_*`, not deleted.
 - `test/cli.test.js` (12 tests) — the exit-1 paths of both CLIs: invalid JSON,
   empty stdin, a pack rejection reachable from real JSON, an unparseable byte,
   an oversized header, incomplete input both alone and after a good frame, and

README.md

@@ -83,12 +83,13 @@ successful (or attempted) unpack. Stream uses that to splice leftover data.
 `unpack(buf, { lazy: true })` wraps maps as objects with accessor
 own-properties and arrays as array-likes with indexed accessors. Nested
 values are not converted until they are read, which is useful for large
-payloads when only a few keys are needed. `JSON.stringify` and
-`util.inspect` materialize via `toJSON` / `inspect.custom`. Lazy arrays are
-not real `Array`s (`Array.isArray` is false); `pack()` still round-trips
-them because it calls `toJSON`. Primitives unpack eagerly even when `lazy`
-is set. `__proto__` and `constructor` keys stay own properties, same as
-eager unpack.
+payloads when only a few keys are needed. The decoder copies `buf` so later
+reads do not depend on the caller's backing store (transfer / detach is
+safe). `JSON.stringify` and `util.inspect` materialize via `toJSON` /
+`inspect.custom`. Lazy arrays are not real `Array`s (`Array.isArray` is
+false); `pack()` still round-trips them because it calls `toJSON`.
+Primitives unpack eagerly even when `lazy` is set. `__proto__` and
+`constructor` keys stay own properties, same as eager unpack.
 
 ### Pack type hints (3.1)
 

src/msgpack.cc

@@ -678,10 +678,13 @@ static v8::Local<v8::Value> MsgpackToJs(const msgpack_object* mo) {
 }
 
 /*
- * Lazy unpack: keep the msgpack zone (and the source Buffer) alive, and wrap
- * maps/arrays as JS objects whose values are accessors. Nested containers are
- * not converted until a property is read. toJSON / inspect.custom materialize
- * through MsgpackToJs so JSON.stringify and util.inspect match eager unpack.
+ * Lazy unpack: keep the msgpack zone (and a session-owned copy of the source
+ * bytes) alive, and wrap maps/arrays as JS objects whose values are accessors.
+ * Nested containers are not converted until a property is read. toJSON /
+ * inspect.custom materialize through MsgpackToJs so JSON.stringify and
+ * util.inspect match eager unpack. The copy is required because msgpack-c
+ * aliases str/bin into the input; a Persistent on the caller's Buffer does
+ * not survive ArrayBuffer transfer.
  */
 class LazySession : public Nan::ObjectWrap {
  public:
@@ -1075,6 +1078,26 @@ NAN_METHOD(Unpack) {
     return Nan::ThrowError("Encountered error unpacking buffer");
   }
 
+  /* Copy before unpack_next so via.str/via.bin alias session-owned bytes.
+   * Nan::Persistent on the caller's Buffer does not keep the backing store
+   * through structuredClone / postMessage transfer (CWE-416). */
+  if (UnpackLazyRequested(info)) {
+    /* GCOVR_EXCL_BR_START: node Buffers are smaller than UINT32_MAX. */
+    if (len > static_cast<size_t>(UINT32_MAX)) {
+      return Nan::ThrowError("Error copying buffer");
+    }
+    /* GCOVR_EXCL_BR_STOP */
+    Nan::MaybeLocal<v8::Object> copied =
+        Nan::CopyBuffer(data, static_cast<uint32_t>(len));
+    /* GCOVR_EXCL_BR_START: CopyBuffer fails only when V8 is out of memory. */
+    if (copied.IsEmpty()) {
+      return Nan::ThrowError("Error copying buffer");
+    }
+    /* GCOVR_EXCL_BR_STOP */
+    buf = copied.ToLocalChecked();
+    data = node::Buffer::Data(buf);
+  }
+
   msgpack_unpacked result;
   msgpack_unpacked_init(&result);
   size_t off = 0;

test/lazy.test.js

@@ -187,4 +187,23 @@ describe('unpack({ lazy: true })', () => {
     assert.equal(99 in o, false);
     assert.equal(1 in o, true);
   });
+
+  it('still reads str and bin after the caller Buffer is transferred', () => {
+    const packed = msgpack.pack({
+      s: 'hello-lazy-uaf-marker-ABCDEFGH',
+      t: 'second-string-XXXXYYYY',
+      n: 7,
+      b: Buffer.from('bin-payload-1234')
+    });
+    const buf = Buffer.allocUnsafeSlow(packed.length);
+    packed.copy(buf);
+    const o = msgpack.unpack(buf, { lazy: true });
+    structuredClone(buf.buffer, { transfer: [buf.buffer] });
+    assert.equal(buf.buffer.byteLength, 0);
+    assert.equal(o.n, 7);
+    assert.equal(o.s, 'hello-lazy-uaf-marker-ABCDEFGH');
+    assert.equal(o.t, 'second-string-XXXXYYYY');
+    assert.equal(Buffer.isBuffer(o.b), true);
+    assert.equal(o.b.toString(), 'bin-payload-1234');
+  });
 });