From f26b00eeaf778be9b649b42dade02fff03928276 Mon Sep 17 00:00:00 2001
From: Soul Lee <alus20x@gmail.com>
Date: Mon, 17 Aug 2026 09:21:11 +0900
Subject: [PATCH] ffi: validate the value passed to the float setters

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <alus20x@gmail.com>
---
 src/ffi/data.cc             | 16 +++++++---------
 test/ffi/test-ffi-memory.js |  6 ++++++
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 6a8d54ca0d39..308bde60cae2 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -16,7 +16,6 @@ using v8::ArrayBuffer;
 using v8::ArrayBufferView;
 using v8::BackingStore;
 using v8::BigInt;
-using v8::Context;
 using v8::FunctionCallbackInfo;
 using v8::Integer;
 using v8::Isolate;
@@ -24,7 +23,6 @@ using v8::Just;
 using v8::JustVoid;
 using v8::Local;
 using v8::Maybe;
-using v8::MaybeLocal;
 using v8::NewStringType;
 using v8::Nothing;
 using v8::Number;
@@ -312,7 +310,6 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
   }
 
   T converted;
-  Local<Context> context = env->context();
 
   if constexpr (std::is_same_v<T, int8_t>) {
     int64_t validated;
@@ -400,15 +397,16 @@ void SetValue(const FunctionCallbackInfo<Value>& args) {
       return;
     }
   } else if constexpr (std::is_same_v<T, float> || std::is_same_v<T, double>) {
-    MaybeLocal<Number> number = value->ToNumber(context);
-    Local<Number> number_local;
-
-    if (!number.ToLocal(&number_local)) {
-      THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a number");
+    if (!value->IsNumber()) {
+      if constexpr (std::is_same_v<T, float>) {
+        THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a float");
+      } else {
+        THROW_ERR_INVALID_ARG_VALUE(env, "Value must be a double");
+      }
       return;
     }
 
-    converted = static_cast<T>(number_local->Value());
+    converted = static_cast<T>(value.As<Number>()->Value());
   } else {
     UNREACHABLE();
   }
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index e5bf4ba07e13..72d37efacd5a 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -273,6 +273,12 @@ test('ffi validates memory access arguments', () => {
     assert.throws(() => ffi.setUint64(ptr, 0, -1n), /Value must be a uint64/);
     assert.throws(() => ffi.setUint64(ptr, 0, 2n ** 64n), /Value must be a uint64/);
     assert.throws(() => ffi.setUint64(ptr, 0, Number.MAX_SAFE_INTEGER + 1), /Value must be a uint64/);
+    assert.throws(() => ffi.setFloat32(ptr, 0, '1.5'), /Value must be a float/);
+    assert.throws(() => ffi.setFloat32(ptr, 0, null), /Value must be a float/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, '1.5'), /Value must be a double/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, true), /Value must be a double/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, {}), /Value must be a double/);
+    assert.throws(() => ffi.setFloat64(ptr, 0, { valueOf: common.mustNotCall() }), /Value must be a double/);
     assert.throws(() => ffi.exportString(1, ptr, 4), { code: 'ERR_INVALID_ARG_TYPE' });
     assert.throws(() => ffi.exportString('ok', ptr, -1), { code: 'ERR_OUT_OF_RANGE' });
     assert.throws(() => ffi.exportString('ok', ptr, 4, 1), { code: 'ERR_INVALID_ARG_TYPE' });