Commit ca13f7a
committed
deps: V8: cherry-pick 501482cbc704
Original commit message:
Fix ValueDeserializer::ReadDouble() bounds check
If end_ is smaller than sizeof(double), the result would wrap
around, and lead to an invalid memory access.
Refs: #37978
Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73800}
PR-URL: #38121
Fixes: #37978
Refs: v8/v8@501482cbc704
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>1 parent dfe3f95 commit ca13f7a
2 files changed
Lines changed: 3 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -36,7 +36,7 @@ | |||
| 36 | 36 | ||
| 37 | 37 | # Reset this number to 0 on major V8 upgrades. | |
| 38 | 38 | # Increment by one for each non-official patch applied to deps/v8. | |
| 39 | - 'v8_embedder_string': '-node.8', | ||
| 39 | + 'v8_embedder_string': '-node.9', | ||
| 40 | 40 | ||
| 41 | 41 | ##### V8 defaults for Node.js ##### | |
| 42 | 42 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1190,7 +1190,8 @@ Maybe<T> ValueDeserializer::ReadZigZag() { | |||
| 1190 | 1190 | ||
| 1191 | 1191 | Maybe<double> ValueDeserializer::ReadDouble() { | |
| 1192 | 1192 | // Warning: this uses host endianness. | |
| 1193 | - if (position_ > end_ - sizeof(double)) return Nothing<double>(); | ||
| 1193 | + if (sizeof(double) > static_cast<unsigned>(end_ - position_)) | ||
| 1194 | + return Nothing<double>(); | ||
| 1194 | 1195 | double value; | |
| 1195 | 1196 | base::Memcpy(&value, position_, sizeof(double)); | |
| 1196 | 1197 | position_ += sizeof(double); | |
0 commit comments