fs: fix crash on negative zero file descriptor - #65888
Open
christianaurichzm wants to merge 1 commit into
Open
Conversation
`isInt32()` accepts -0 because `-0 === (-0 | 0)`, but V8 does not represent -0 as an Int32 value, so `Value::IsInt32()` rejects it. The utf8 fast paths of `readFileSync()` and `writeFileSync()` hand the value straight to the binding, which then took it for a path and aborted on the null check. Coerce -0 to 0 before the call, matching `getValidatedFd()` and the rest of fs, where -0 is a valid way to name file descriptor 0. Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
nodejs-github-bot
added
fs
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #65888 +/- ##
==========================================
+ Coverage 90.16% 90.18% +0.02%
==========================================
Files 771 771
Lines 265094 265102 +8
Branches 50355 50364 +9
==========================================
+ Hits 239027 239091 +64
+ Misses 17011 16963 -48
+ Partials 9056 9048 -8
🚀 New features to boost your workflow:
|
meixg
approved these changes
Sep 8, 2026
meixg
added
the
request-ci
github-actions
Bot
removed
the
request-ci
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fs.writeFileSync(-0, '')andfs.appendFileSync(-0, '')currently abort in the utf8 fast path. I also found the same issue withfs.readFileSync(-0, 'utf8').The JS side treats
-0as an int32 file descriptor, but V8 does not report-0as anInt32in the binding. The binding then takes it for a path and hits the null check.This normalizes
-0to0before entering the binding, matching the existing fs behavior for negative-zero file descriptors.Tests were added to
test/parallel/test-fs-negative-zero.js.Fixes: #65886