crates/napi/src/bindgen_runtime/js_values/arraybuffer.rs (6)

257-285: Potential use-after-free: data slice returned after finalize may have freed the source.

In the fallback path (lines 257-269), after finalize(*env, hint) is called (line 268), the function continues and returns an ArrayBuffer on line 283 with:

data: unsafe { std::slice::from_raw_parts(data.cast(), len) }

However, finalize is a user-provided callback that likely frees the original data pointer. The returned ArrayBuffer would then contain a dangling pointer.

In the fallback path, the data was copied to underlying_data (line 265), so the returned slice should reference underlying_data, not the original data.

🔎 Proposed fix

The fix requires tracking whether we're in the fallback path and using the correct pointer:

   if status == sys::Status::napi_no_external_buffers_allowed {
     let (hint, finalize) = *Box::from_raw(hint_ptr);
     let mut underlying_data = ptr::null_mut();
     status = unsafe {
       sys::napi_create_arraybuffer(env.0, len, &mut underlying_data, &mut arraybuffer_value)
     };
     // Copy data before calling finalize, since finalize may free the source data
     if status == sys::Status::napi_ok && len > 0 {
       unsafe { std::ptr::copy_nonoverlapping(data.cast(), underlying_data, len) };
     }
     // Always call finalize to clean up caller's resources, even on error
     finalize(*env, hint);
     check_status!(status, "Failed to create arraybuffer from data")?;
+    return Ok(Self {
+      value: Value {
+        env: env.0,
+        value: arraybuffer_value,
+        value_type: ValueType::Object,
+      },
+      data: if len == 0 {
+        &[]
+      } else {
+        unsafe { std::slice::from_raw_parts(underlying_data.cast(), len) }
+      },
+    });
   } else {
     check_status!(status, "Failed to create arraybuffer from data")?;
   }

   Ok(Self {
     value: Value {
       env: env.0,
       value: arraybuffer_value,
       value_type: ValueType::Object,
     },
     data: if len == 0 {
       &[]
     } else {
       unsafe { std::slice::from_raw_parts(data.cast(), len) }
     },
   })

---

767-782: Missing status validation and length guard in impl_typed_array! macro fallback.

The ArrayBuffer::from_data and ArrayBuffer::from_external methods were updated to validate status before copying and guard copies with len > 0. However, the impl_typed_array! macro (used for Uint8Array, Int32Array, etc.) still performs an unconditional copy at line 778:

unsafe { std::ptr::copy_nonoverlapping(hint.data.cast(), underlying_data, length) };

This doesn't check if napi_create_arraybuffer succeeded before copying, and doesn't guard against zero-length buffers. Per the PR objective to "apply similar status checks and guarded copies across typed array paths", this should be consistent.

🔎 Proposed fix

             if status == napi_sys::Status::napi_no_external_buffers_allowed {
               let hint = unsafe { Box::from_raw(hint_ptr) };
               let mut underlying_data = ptr::null_mut();
               let status = unsafe {
                 sys::napi_create_arraybuffer(
                   env,
                   length,
                   &mut underlying_data,
                   &mut arraybuffer_value,
                 )
               };
-              unsafe { std::ptr::copy_nonoverlapping(hint.data.cast(), underlying_data, length) };
-              status
+              if status == sys::Status::napi_ok && length > 0 {
+                unsafe { std::ptr::copy_nonoverlapping(hint.data.cast(), underlying_data, length) };
+              }
+              status
             } else {
               status
             }

---

1053-1071: Missing status validation in impl_from_slice! macro's from_external.

Similar to the impl_typed_array! macro, the impl_from_slice! macro's from_external method at lines 1064-1066 copies data unconditionally:

let underlying_slice: &mut [u8] =
  unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), array_buffer_len) };
underlying_slice.copy_from_slice(unsafe { std::slice::from_raw_parts(data.cast(), array_buffer_len) });

This doesn't validate that napi_create_arraybuffer succeeded before dereferencing underlying_data, which could be null or invalid if the call failed.

🔎 Proposed fix

         status = if status == sys::Status::napi_no_external_buffers_allowed {
           let (hint, finalize) = *Box::from_raw(hint_ptr);
           let mut underlying_data = ptr::null_mut();
           let status = unsafe {
             sys::napi_create_arraybuffer(
               env.0,
               array_buffer_len,
               &mut underlying_data,
               &mut arraybuffer_value,
             )
           };
-          let underlying_slice: &mut [u8] =
-            unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), array_buffer_len) };
-          underlying_slice.copy_from_slice(unsafe { std::slice::from_raw_parts(data.cast(), array_buffer_len) });
+          if status == sys::Status::napi_ok && array_buffer_len > 0 {
+            let underlying_slice: &mut [u8] =
+              unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), array_buffer_len) };
+            underlying_slice.copy_from_slice(unsafe { std::slice::from_raw_parts(data.cast(), array_buffer_len) });
+          }
           finalize(*env, hint);
           status
         } else {
           status
         };

---

1667-1680: Missing status validation before copy in Uint8ClampedSlice::from_data.

At lines 1673-1675, data is copied unconditionally:

let underlying_slice: &mut [u8] =
  unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), len) };
underlying_slice.copy_from_slice(data.as_slice());

The status check on line 1680 happens after this copy. If napi_create_arraybuffer fails, underlying_data may be null or invalid, leading to undefined behavior.

🔎 Proposed fix

       let mut underlying_data = ptr::null_mut();
       status = unsafe { sys::napi_create_arraybuffer(env.0, len, &mut underlying_data, &mut buf) };
-      let underlying_slice: &mut [u8] =
-        unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), len) };
-      underlying_slice.copy_from_slice(data.as_slice());
+      if status == napi_sys::Status::napi_ok && len > 0 {
+        let underlying_slice: &mut [u8] =
+          unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), len) };
+        underlying_slice.copy_from_slice(data.as_slice());
+      }
       inner_ptr = underlying_data.cast();
     } else {
       mem::forget(data);
     }
     check_status!(status, "Failed to create buffer slice from data")?;

---

1763-1777: Missing status validation before copy in Uint8ClampedSlice::from_external.

Same issue as from_data - the copy at lines 1769-1771 occurs before the status check at line 1777.

🔎 Proposed fix

     status = if status == sys::Status::napi_no_external_buffers_allowed {
       let (hint, finalize) = *Box::from_raw(hint_ptr);
       let mut underlying_data = ptr::null_mut();
       let status = unsafe {
         sys::napi_create_arraybuffer(env.0, len, &mut underlying_data, &mut arraybuffer_value)
       };
-      let underlying_slice: &mut [u8] =
-        unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), len) };
-      underlying_slice.copy_from_slice(unsafe { std::slice::from_raw_parts(data, len) });
+      if status == sys::Status::napi_ok && len > 0 {
+        let underlying_slice: &mut [u8] =
+          unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), len) };
+        underlying_slice.copy_from_slice(unsafe { std::slice::from_raw_parts(data, len) });
+      }
       finalize(*env, hint);
       status
     } else {
       status
     };

---

949-969: Missing status validation before copy in impl_from_slice! macro's from_data.

At lines 962-964, data is copied unconditionally after napi_create_arraybuffer:

let underlying_slice: &mut [u8] =
  unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), data.len()) };
underlying_slice.copy_from_slice(unsafe { core::slice::from_raw_parts(inner_ptr.cast(), array_buffer_len) });

The status check on line 969 happens after this copy.

🔎 Proposed fix

         if status == napi_sys::Status::napi_no_external_buffers_allowed {
           unsafe {
             let _ = Box::from_raw(finalize_hint);
           }
           let mut underlying_data = ptr::null_mut();
           status = unsafe {
             sys::napi_create_arraybuffer(
               env.0,
               array_buffer_len,
               &mut underlying_data,
               &mut buf,
             )
           };
-          let underlying_slice: &mut [u8] =
-            unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), data.len()) };
-          underlying_slice.copy_from_slice(unsafe { core::slice::from_raw_parts(inner_ptr.cast(), array_buffer_len) });
+          if status == napi_sys::Status::napi_ok && array_buffer_len > 0 {
+            let underlying_slice: &mut [u8] =
+              unsafe { std::slice::from_raw_parts_mut(underlying_data.cast(), array_buffer_len) };
+            underlying_slice.copy_from_slice(unsafe { core::slice::from_raw_parts(inner_ptr.cast(), array_buffer_len) });
+          }
           inner_ptr = underlying_data.cast();
         } else {
           mem::forget(data);
         }