zlib: reject invalid zstd dictionaries

Signed-off-by: James M Snell <jsnell@cloudflare.com>
PR-URL: #65867
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>

Author: jasnell

lib/zlib.js

@@ -950,7 +950,11 @@ class Zstd extends ZlibBase {
       if (isAnyArrayBuffer(dictionary)) {
         dictionary = new Uint8Array(dictionary);
       } else {
-        dictionary = undefined;
+        throw new ERR_INVALID_ARG_TYPE(
+          'options.dictionary',
+          ['Buffer', 'TypedArray', 'DataView', 'ArrayBuffer'],
+          dictionary,
+        );
       }
     }
 

src/node_zlib.cc

@@ -1820,8 +1820,7 @@ CompressionError ZstdDecompressContext::Init(uint64_t pledged_src_size,
 }
 
 CompressionError ZstdDecompressContext::ResetStream() {
-  const size_t result =
-      ZSTD_DCtx_reset(dctx_.get(), ZSTD_reset_session_only);
+  const size_t result = ZSTD_DCtx_reset(dctx_.get(), ZSTD_reset_session_only);
   if (ZSTD_isError(result)) {
     const ZSTD_ErrorCode error = ZSTD_getErrorCode(result);
     return CompressionError(

test/parallel/test-zlib-zstd-dictionary.js

@@ -40,3 +40,24 @@ for (const dict of [arrayBuffer, uint8, dataView]) {
   const decompressed = zlib.zstdDecompressSync(compressed, { dictionary: dict });
   assert.strictEqual(decompressed.toString(), input.toString());
 }
+
+for (const dictionary of [null, 'string', 123, true, {}, [1, 2, 3]]) {
+  const options = { dictionary };
+  const expected = {
+    code: 'ERR_INVALID_ARG_TYPE',
+    name: 'TypeError',
+  };
+
+  assert.throws(() => zlib.createZstdCompress(options), expected);
+  assert.throws(() => zlib.createZstdDecompress(options), expected);
+  assert.throws(() => zlib.zstdCompressSync(input, options), expected);
+  assert.throws(() => zlib.zstdDecompressSync(input, options), expected);
+  assert.throws(
+    () => zlib.zstdCompress(input, options, common.mustNotCall()),
+    expected,
+  );
+  assert.throws(
+    () => zlib.zstdDecompress(input, options, common.mustNotCall()),
+    expected,
+  );
+}