src: validate stdio entries in process_wrap

src/process_wrap.cc

@@ -140,6 +140,12 @@ class ProcessWrap : public HandleWrap {
       if (!stdios->Get(context, i).ToLocal(&val)) {
         return Nothing<void>();
       }
+      if (!val->IsObject()) {
+        THROW_ERR_INVALID_ARG_TYPE(env,
+                                   "options.stdio[%u] must be an object",
+                                   i);
+        return Nothing<void>();
+      }
       Local<Object> stdio = val.As<Object>();
       Local<Value> type;
       if (!stdio->Get(context, env->type_string()).ToLocal(&type)) {

test/parallel/test-child-process-array-prototype-setter.js

@@ -0,0 +1,29 @@
+'use strict';
+require('../common');
+
+const assert = require('assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const script = `
+Object.defineProperty(Array.prototype, '2', {
+  __proto__: null,
+  set() {},
+  configurable: true,
+});
+
+try {
+  require('child_process').spawn(process.execPath, ['-e', '0']);
+  console.log('NO_ERROR');
+} catch (error) {
+  console.log(error.code);
+}
+`;
+
+spawnSyncAndAssert(process.execPath, ['-e', script], {
+  stdout: (output) => {
+    assert.match(output, /^ERR_INVALID_ARG_TYPE\\r?\\n$/);
+  },
+  stderr: (output) => {
+    assert.doesNotMatch(output, /FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal/);
+  },
+});