FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

v8.deserialize: Fix out of bounds write by arneg · Pull Request #55269 · nodejs/node · GitHub

/ node Public

v8.deserialize: Fix out of bounds write - #55269

Closed
arneg wants to merge 1 commit into
nodejs:mainfrom
arneg:bugfix/fix-out-of-bounds-write-in-deserializer
ConversationCommits (1)ChecksFiles changed
Closed

v8.deserialize: Fix out of bounds write#55269
arneg wants to merge 1 commit into
nodejs:mainfrom
arneg:bugfix/fix-out-of-bounds-write-in-deserializer

Conversation

arneg commented Oct 4, 2024

Copy link
Copy Markdown

When v8.deserialized is passed a Buffer with non-zero byteOffset, it will call copy and try to copy more bytes than are allocated in the destination buffer. This will then call the SlowCopy method which will call memmove and write bytes after the buffer.

This crash has been observed with the parcel tool.

v8.deserialize: Fix out of bounds write
b61f85b 
When v8.deserialized is passed a Buffer with non-zero byteOffset,
it will call copy and try to copy more bytes than are allocated
in the destination buffer. This will then call the SlowCopy method
which will call memmove and write bytes after the buffer.

This bug has been observed with the parcel tool.
nodejs-github-bot added the needs-ci PRs that need a full CI run. label Oct 4, 2024

arneg commented Oct 4, 2024

Copy link
Copy Markdown
Author

While debugging this I also ended up adding this check to SlowCopy

CHECK(to_copy <= (target_length - target_start));

Is it worth adding checks like that?

arneg commented Oct 4, 2024

Copy link
Copy Markdown
Author

PR #55261 is an attempt to fix the same issue.

avivkeller commented Oct 5, 2024

Copy link
Copy Markdown
Member

@ronag is this a duplicate of your PR? If so, feel free to close it as such :-)

codecov Bot commented Oct 5, 2024 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 88.40%. Comparing base (d2ad9b4) to head (b61f85b).
Report is 11 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #55269      +/-   ##
==========================================
- Coverage   88.41%   88.40%   -0.02%     
==========================================
  Files         652      652              
  Lines      186594   186589       -5     
  Branches    36054    36060       +6     
==========================================
- Hits       164980   164954      -26     
- Misses      14883    14900      +17     
- Partials     6731     6735       +4
Files with missing lines Coverage Δ
lib/v8.js 99.32% <100.00%> (ø)

... and 24 files with indirect coverage changes

arneg commented Oct 7, 2024

Copy link
Copy Markdown
Author

PR #55261 fixes the same issue and is hopefully merged soon.

arneg closed this Oct 7, 2024
arneg deleted the bugfix/fix-out-of-bounds-write-in-deserializer branch October 7, 2024 08:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL