crypto: use primordials in HKDF info validation

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Author: panva

lib/internal/crypto/hkdf.js

@@ -4,6 +4,8 @@ const {
   ArrayBuffer,
   FunctionPrototypeCall,
   PromiseResolve,
+  TypedArrayPrototypeGetByteLength,
+  Uint8Array,
 } = primordials;
 
 const {
@@ -22,6 +24,7 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
+  getBufferSourceByteLength,
   jobPromise,
   normalizeHashName,
   toBuf,
@@ -41,6 +44,7 @@ const {
 const {
   isAnyArrayBuffer,
   isArrayBufferView,
+  isSharedArrayBuffer,
 } = require('internal/util/types');
 
 const {
@@ -51,6 +55,13 @@ const {
   hideStackFrames,
 } = require('internal/errors');
 
+function getByteSourceByteLength(source) {
+  if (isSharedArrayBuffer(source)) {
+    return TypedArrayPrototypeGetByteLength(new Uint8Array(source));
+  }
+  return getBufferSourceByteLength(source);
+}
+
 const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   validateString.withoutStackTrace(hash, 'digest');
   key = prepareKey(key);
@@ -61,11 +72,12 @@ const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   // Coerce -0 to +0.
   length += 0;
 
-  if (info.byteLength > 1024) {
+  const infoByteLength = getByteSourceByteLength(info);
+  if (infoByteLength > 1024) {
     throw new ERR_OUT_OF_RANGE.HideStackFramesError(
       'info',
       'must not contain more than 1024 bytes',
-      info.byteLength);
+      infoByteLength);
   }
 
   return {
@@ -103,18 +115,20 @@ function prepareKey(key) {
   return key;
 }
 
-function hkdf(hash, key, salt, info, length, callback) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
+function createHkdfJob(mode, params) {
+  return new HKDFJob(
+    mode,
+    params.hash,
+    params.key,
+    params.salt,
+    params.info,
+    params.length);
+}
 
+function hkdf(hash, key, salt, info, length, callback) {
+  const params = validateParameters(hash, key, salt, info, length);
   validateFunction(callback, 'callback');
-
-  const job = new HKDFJob(kCryptoJobAsync, hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobAsync, params);
 
   job.ondone = (error, bits) => {
     if (error) return FunctionPrototypeCall(callback, job, error);
@@ -125,15 +139,8 @@ function hkdf(hash, key, salt, info, length, callback) {
 }
 
 function hkdfSync(hash, key, salt, info, length) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
-
-  const job = new HKDFJob(kCryptoJobSync, hash, key, salt, info, length);
+  const params = validateParameters(hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobSync, params);
   const { 0: err, 1: bits } = job.run();
   if (err !== undefined)
     throw err;

test/parallel/test-crypto-hkdf.js

@@ -108,6 +108,23 @@ const { hasOpenSSL } = require('../common/crypto');
     code: 'ERR_OUT_OF_RANGE'
   });
 
+  {
+    const info = new Uint8Array(2048);
+    Object.defineProperty(info, 'byteLength', {
+      __proto__: null,
+      get() {
+        return 1;
+      },
+    });
+
+    const calls = [
+      () => hkdf('sha256', 'a', '', info, 10, common.mustNotCall()),
+      () => hkdfSync('sha256', 'a', '', info, 10),
+    ];
+    for (const call of calls)
+      assert.throws(call, { code: 'ERR_OUT_OF_RANGE' });
+  }
+
   assert.throws(
     () => hkdf('sha512', 'a', '', '', 64 * 255 + 1, common.mustNotCall()), {
       code: 'ERR_CRYPTO_INVALID_KEYLEN'