Skip to content

Commit e6ebc65

Browse files
author
vamsi
committed
Fix syntax crash from null filter
When a filter or validate function throws null, the global event loop in loop.js unsafely tries to access its properties, crashing couchjs. This adds safe null checks to the global handler to prevent complete denial of service.
1 parent 3083d28 commit e6ebc65

2 files changed

Lines changed: 5 additions & 1 deletion

File tree

share/server/loop.js

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,10 @@ var Loop = function() {
135135
"rereduce" : Views.rereduce
136136
};
137137
function handleError(e) {
138+
if (e == null) {
139+
respond(["error", "unnamed_error", String(e)]);
140+
return;
141+
}
138142
var type = e[0];
139143
if (type == "fatal") {
140144
e[0] = "error"; // we tell the client it was a fatal error by dying

share/server/validate.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ var Validate = {
1616
fun.apply(ddoc, args);
1717
respond(1);
1818
} catch (error) {
19-
if (error.name && error.stack) {
19+
if (error && error.name && error.stack) {
2020
throw error;
2121
}
2222
respond(error);

0 commit comments

Comments
 (0)