{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/21397","repository_url":"https://api.github.com/repos/nodejs/node","labels_url":"https://api.github.com/repos/nodejs/node/issues/21397/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/21397/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/21397/events","html_url":"https://github.com/nodejs/node/pull/21397","id":333528850,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk1NzE4ODUz","number":21397,"title":"Change `timingSafeEqual` to use `byteLength`.","user":{"login":"ZaneHannanAU","id":20490671,"node_id":"MDQ6VXNlcjIwNDkwNjcx","avatar_url":"https://avatars0.githubusercontent.com/u/20490671?v=4","gravatar_id":"","url":"https://api.github.com/users/ZaneHannanAU","html_url":"https://github.com/ZaneHannanAU","followers_url":"https://api.github.com/users/ZaneHannanAU/followers","following_url":"https://api.github.com/users/ZaneHannanAU/following{/other_user}","gists_url":"https://api.github.com/users/ZaneHannanAU/gists{/gist_id}","starred_url":"https://api.github.com/users/ZaneHannanAU/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ZaneHannanAU/subscriptions","organizations_url":"https://api.github.com/users/ZaneHannanAU/orgs","repos_url":"https://api.github.com/users/ZaneHannanAU/repos","events_url":"https://api.github.com/users/ZaneHannanAU/events{/privacy}","received_events_url":"https://api.github.com/users/ZaneHannanAU/received_events","type":"User","site_admin":false},"labels":[{"id":155267357,"node_id":"MDU6TGFiZWwxNTUyNjczNTc=","url":"https://api.github.com/repos/nodejs/node/labels/crypto","name":"crypto","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-06-19T05:58:11Z","updated_at":"2018-06-19T10:53:10Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/nodejs/node/pulls/21397","html_url":"https://github.com/nodejs/node/pull/21397","diff_url":"https://github.com/nodejs/node/pull/21397.diff","patch_url":"https://github.com/nodejs/node/pull/21397.patch"},"body":"Former implementation of `timingSafeEqual` would allow different length; allowing a core dump.\r\n\r\n```shell-session\r\n[zeen3@zeen3 ~]$ node\r\nRunning node v10.4.1 (npm v6.1.0)\r\n> crypto.timingSafeEqual(new BigUint64Array(32), new Uint32Array(32))\r\nnode[16304]: ../src/node_crypto.cc:5158:void node::crypto::TimingSafeEqual(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `(buf_length) == (Buffer::Length(args[1]))' failed.\r\n 1: node::Abort() [node]\r\n 2: 0x8938b5 [node]\r\n 3: 0x97212a [node]\r\n 4: 0xb00989 [node]\r\n 5: v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) [node]\r\n 6: 0x2dbaff1841bd\r\nAborted (core dumped)\r\n[zeen3@zeen3 ~]$ node\r\nRunning node v10.4.1 (npm v6.1.0)\r\n> crypto.timingSafeEqual(new BigUint64Array(32), new Uint32Array(64))\r\nRangeError [ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH]: Input buffers must have the same length\r\n    at Object.timingSafeEqual (internal/crypto/util.js:81:11)\r\n> process.binding('crypto').timingSafeEqual(new BigUint64Array(32), new Uint32Array(64))\r\ntrue\r\n> crypto.timingSafeEqual(new BigUint64Array(32), new Uint32Array(32))\r\nnode[16856]: ../src/node_crypto.cc:5158:void node::crypto::TimingSafeEqual(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `(buf_length) == (Buffer::Length(args[1]))' failed.\r\n 1: node::Abort() [node]\r\n 2: 0x8938b5 [node]\r\n 3: 0x97212a [node]\r\n 4: 0xb00989 [node]\r\n 5: v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) [node]\r\n 6: 0x128c0a5041bd\r\nAborted (core dumped)\r\n[zeen3@zeen3 ~]$ \r\n```\r\n\r\nThough unlikely to occur it's possible.\r\n\r\n<!--\r\nThank you for your pull request. Please provide a description above and review\r\nthe requirements below.\r\n\r\nBug fixes and new features should include tests and possibly benchmarks.\r\n\r\nContributors guide: https://github.com/nodejs/node/blob/master/CONTRIBUTING.md\r\n-->\r\n\r\n##### Checklist\r\n<!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->\r\n\r\n- [X] tests and/or benchmarks are included\r\n"},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/398357988","html_url":"https://github.com/nodejs/node/pull/21397#issuecomment-398357988","issue_url":"https://api.github.com/repos/nodejs/node/issues/21397","id":398357988,"node_id":"MDEyOklzc3VlQ29tbWVudDM5ODM1Nzk4OA==","user":{"login":"bnoordhuis","id":275871,"node_id":"MDQ6VXNlcjI3NTg3MQ==","avatar_url":"https://avatars0.githubusercontent.com/u/275871?v=4","gravatar_id":"","url":"https://api.github.com/users/bnoordhuis","html_url":"https://github.com/bnoordhuis","followers_url":"https://api.github.com/users/bnoordhuis/followers","following_url":"https://api.github.com/users/bnoordhuis/following{/other_user}","gists_url":"https://api.github.com/users/bnoordhuis/gists{/gist_id}","starred_url":"https://api.github.com/users/bnoordhuis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnoordhuis/subscriptions","organizations_url":"https://api.github.com/users/bnoordhuis/orgs","repos_url":"https://api.github.com/users/bnoordhuis/repos","events_url":"https://api.github.com/users/bnoordhuis/events{/privacy}","received_events_url":"https://api.github.com/users/bnoordhuis/received_events","type":"User","site_admin":false},"created_at":"2018-06-19T10:53:10Z","updated_at":"2018-06-19T10:53:10Z","author_association":"MEMBER","body":"@ZaneHannanAU `git commit --amend`, then `git push your-remote +HEAD:patch-1`\r\n\r\n> I'm actually more surprised it passed the tests.\r\n\r\nThat specific check predates general ArrayBufferView support.  Back then, only Buffer existed and it wasn't an instance of Uint8Array."}}
{"actor":{"display_login":"bnoordhuis"}}