Commit 8951c19
deps: V8: cherry-pick 501482cbc704
Original commit message:
Fix ValueDeserializer::ReadDouble() bounds check
If end_ is smaller than sizeof(double), the result would wrap
around, and lead to an invalid memory access.
Refs: #37978
Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73800}
PR-URL: #38121
Fixes: #37978
Refs: v8/v8@501482cbc704
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>1 parent f65eadc commit 8951c19
2 files changed
Lines changed: 3 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -36,7 +36,7 @@ | |||
| 36 | 36 | ||
| 37 | 37 | # Reset this number to 0 on major V8 upgrades. | |
| 38 | 38 | # Increment by one for each non-official patch applied to deps/v8. | |
| 39 | - 'v8_embedder_string': '-node.60', | ||
| 39 | + 'v8_embedder_string': '-node.61', | ||
| 40 | 40 | ||
| 41 | 41 | ##### V8 defaults for Node.js ##### | |
| 42 | 42 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1175,7 +1175,8 @@ Maybe<T> ValueDeserializer::ReadZigZag() { | |||
| 1175 | 1175 | ||
| 1176 | 1176 | Maybe<double> ValueDeserializer::ReadDouble() { | |
| 1177 | 1177 | // Warning: this uses host endianness. | |
| 1178 | - if (position_ > end_ - sizeof(double)) return Nothing<double>(); | ||
| 1178 | + if (sizeof(double) > static_cast<unsigned>(end_ - position_)) | ||
| 1179 | + return Nothing<double>(); | ||
| 1179 | 1180 | double value; | |
| 1180 | 1181 | memcpy(&value, position_, sizeof(double)); | |
| 1181 | 1182 | position_ += sizeof(double); | |
0 commit comments