util: inspect: avoid a crash on a DataView with a detached buffer

nodejs · Jan 20, 2025 · 76816c0 · 76816c0
1 parent da5f7ac
commit 76816c0
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 6 deletions.
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
@@ -1099,6 +1099,23 @@ function formatRaw(ctx, value, recurseTimes, typedArray) {
   try {
     output = formatter(ctx, value, recurseTimes);
     for (i = 0; i < keys.length; i++) {
+      if (
+        isDataView(value)
+        && (
+          keys[i] === 'byteLength'
+          || keys[i] === 'byteOffset'
+        )
+      ) {
+        try {
+          const buffer = new Uint8Array(value.buffer);
+        } catch {
+          ArrayPrototypePush(
+            output,
+            formatValue(ctx, value.buffer.byteLength)
+          );
+          continue;
+        }
+      }
       ArrayPrototypePush(
         output,
         formatProperty(ctx, value, recurseTimes, keys[i], extrasType),
@@ -1994,8 +2011,7 @@ function formatProperty(ctx, value, recurseTimes, key, type, desc,
                         original = value) {
   let name, str;
   let extra = ' ';
-  desc ||= ObjectGetOwnPropertyDescriptor(value, key) ||
-    { value: value[key], enumerable: true };
+  desc ||= ObjectGetOwnPropertyDescriptor(value, key) || { value: value[key], enumerable: true };
   if (desc.value !== undefined) {
     const diff = (ctx.compact !== true || type !== kObjectType) ? 2 : 3;
     ctx.indentationLvl += diff;

diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
@@ -206,11 +206,20 @@ assert.doesNotMatch(
 
 {
   const ab = new ArrayBuffer(42);
+  const dv = new DataView(ab);
+
   assert.strictEqual(ab.byteLength, 42);
   new MessageChannel().port1.postMessage(ab, [ ab ]);
   assert.strictEqual(ab.byteLength, 0);
-  assert.strictEqual(util.inspect(ab),
-                     'ArrayBuffer { (detached), byteLength: 0 }');
+  assert.strictEqual(
+    util.inspect(ab),
+    'ArrayBuffer { (detached), byteLength: 0 }',
+  );
+
+  assert.strictEqual(
+    util.inspect(dv),
+    'DataView { 0, 0, buffer: ArrayBuffer { (detached), byteLength: 0 } }',
+  );
 }
 
 // Truncate output for ArrayBuffers using plural or singular bytes
@@ -294,15 +303,17 @@ assert.doesNotMatch(
 });
 
 // Now check that declaring a TypedArray in a different context works the same.
-[ Float32Array,
+[
+  Float32Array,
   Float64Array,
   Int16Array,
   Int32Array,
   Int8Array,
   Uint16Array,
   Uint32Array,
   Uint8Array,
-  Uint8ClampedArray ].forEach((constructor) => {
+  Uint8ClampedArray,
+].forEach((constructor) => {
   const length = 2;
   const byteLength = length * constructor.BYTES_PER_ELEMENT;
   const array = vm.runInNewContext(