Server Reflection - Node.js v22.7.0 RangeError [ERR_BUFFER_OUT_OF_BOUNDS]: "length" is outside of buffer bounds

[wavedeck]

This is a FYI, easing debugging for other developers trying to use @grpc/reflection specifically with Node.js v22.7.0

Problem description

I wanted to add server reflection with the @grpc/reflection package today and noticed that my application crashed upon it internally trying to create the package definition for the internal reflection.proto file.

After some debugging, I have noticed that the crash is due to a bug in Node.js v22.7.x because the buffer length value is larger than the actual buffer. Updating to Node.js v22.8.0 which was released 3 days ago (September 6th, 2024) fixed the issue and the application doesn't crash anymore.

In Node.js v22.8.0, the buffer length gets truncated instead of trying to read past the buffer preventing a crash.
For the applied fix see nodejs/node#54524

Environment

• OS name, version and architecture: macOS Sonoma 14.6.1 aarch64
• Node version: v22.7.0
• Node installation method: fnm
• Package name and version: @grpc/reflection@1.0.4

Additional context

Stack Trace:

 node:internal/buffer:1066
      throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
RangeError [ERR_BUFFER_OUT_OF_BOUNDS]: "length" is outside of buffer bounds
    at proto.utf8Write (node:internal/buffer:1066:13)
    at Op.writeStringBuffer [as fn] (node_modules/.pnpm/protobufjs@7.4.0/node_modules/protobufjs/src/writer_buffer.js:61:13)
    at BufferWriter.finish (node_modules/.pnpm/protobufjs@7.4.0/node_modules/protobufjs/src/writer.js:453:14)
    at node_modules/.pnpm/@grpc+proto-loader@0.7.13/node_modules/@grpc/proto-loader/build/src/index.js:177:109
    at Array.map (<anonymous>)
    at createPackageDefinition (node_modules/.pnpm/@grpc+proto-loader@0.7.13/node_modules/@grpc/proto-loader/build/src/index.js:177:39)
    at Object.loadSync (node_modules/.pnpm/@grpc+proto-loader@0.7.13/node_modules/@grpc/proto-loader/build/src/index.js:223:12)
    at ReflectionV1Implementation.addToServer (node_modules/.pnpm/@grpc+reflection@1.0.4_@grpc+grpc-js@1.11.2/node_modules/@grpc/reflection/build/src/implementations/reflection-v1.js:130:43)
    at ReflectionService.addToServer (node_modules/.pnpm/@grpc+reflection@1.0.4_@grpc+grpc-js@1.11.2/node_modules/@grpc/reflection/build/src/service.js:29:17)
    at file://dist/index.js:15:12 {
  code: 'ERR_BUFFER_OUT_OF_BOUNDS'
}

[wavedeck]

PS: The current LTS version of Node.js (v20.17.0) is working fine. This is specifically a bug in v22.7.0 that might or might not be worth trying to prevent on the library side.

[murgatroid99]

This bug is triggered in Protobuf.js. The bug in that library (protobufjs/protobuf.js#2025) is considered resolved by the fix in the Node runtime, so I will make the same consideration here.