Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

deps: V8: cherry-pick 501482cbc704 #38121

Merged
merged 2 commits into from Apr 9, 2021
Merged

deps: V8: cherry-pick 501482cbc704 #38121

merged 2 commits into from Apr 9, 2021

Conversation

cjihrig
Copy link
Contributor

@cjihrig cjihrig commented Apr 7, 2021

Original commit message:

Fix ValueDeserializer::ReadDouble() bounds check

If end_ is smaller than sizeof(double), the result would wrap
around, and lead to an invalid memory access.

Refs: https://github.com/nodejs/node/issues/37978
Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73800}

Refs: v8/v8@501482cbc704
Fixes: #37978

@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency. labels Apr 7, 2021
@gengjiawen
Copy link
Member

common.gypi also need updated (v8_embedder_string part).

RaisinTen
RaisinTen reviewed Apr 7, 2021
View reviewed changes
Copy link
Contributor

@RaisinTen RaisinTen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we also add a test at test/parallel/test-v8-serdes.js?

@cjihrig
Copy link
Contributor Author

cjihrig commented Apr 8, 2021

common.gypi also need updated (v8_embedder_string part).

Done.

Should we also add a test at test/parallel/test-v8-serdes.js?

Done.

@nodejs-github-bot
Copy link
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/37276/

@nodejs-github-bot
Copy link
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/37295/

@RaisinTen RaisinTen added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Apr 8, 2021
@cjihrig
deps: V8: cherry-pick 501482cbc704
ca13f7a 
Original commit message:

    Fix ValueDeserializer::ReadDouble() bounds check

    If end_ is smaller than sizeof(double), the result would wrap
    around, and lead to an invalid memory access.

    Refs: nodejs#37978
    Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353
    Reviewed-by: Marja Hölttä <marja@chromium.org>
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#73800}

PR-URL: nodejs#38121
Fixes: nodejs#37978
Refs: v8/v8@501482cbc704
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
@cjihrig
test: add regression test for serdes readDouble()
e96773b 
Refs: nodejs#37978
PR-URL: nodejs#38121
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
@cjihrig cjihrig merged commit e96773b into nodejs:master Apr 9, 2021
@cjihrig cjihrig deleted the cp branch April 9, 2021 02:28
@BethGriggs BethGriggs mentioned this pull request Apr 12, 2021
Merged
targos pushed a commit that referenced this pull request May 1, 2021
@cjihrig @targos
deps: V8: cherry-pick 501482cbc704
8951c19 
Original commit message:

    Fix ValueDeserializer::ReadDouble() bounds check

    If end_ is smaller than sizeof(double), the result would wrap
    around, and lead to an invalid memory access.

    Refs: #37978
    Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353
    Reviewed-by: Marja Hölttä <marja@chromium.org>
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#73800}

PR-URL: #38121
Fixes: #37978
Refs: v8/v8@501482cbc704
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
targos pushed a commit that referenced this pull request May 1, 2021
@cjihrig @targos
test: add regression test for serdes readDouble()
aa0d814 
Refs: #37978
PR-URL: #38121
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
@danielleadams danielleadams mentioned this pull request May 3, 2021
Merged
danielleadams pushed a commit that referenced this pull request May 8, 2021
@cjihrig @danielleadams
deps: V8: cherry-pick 501482cbc704
a6dba4d 
Original commit message:

    Fix ValueDeserializer::ReadDouble() bounds check

    If end_ is smaller than sizeof(double), the result would wrap
    around, and lead to an invalid memory access.

    Refs: #37978
    Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353
    Reviewed-by: Marja Hölttä <marja@chromium.org>
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#73800}

PR-URL: #38121
Fixes: #37978
Refs: v8/v8@501482cbc704
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
danielleadams pushed a commit that referenced this pull request May 8, 2021
@cjihrig @danielleadams
test: add regression test for serdes readDouble()
7162bea 
Refs: #37978
PR-URL: #38121
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jasnell jasnell jasnell approved these changes

@gengjiawen gengjiawen gengjiawen approved these changes

@RaisinTen RaisinTen RaisinTen approved these changes

Assignees
No one assigned
Labels
author ready PRs that have at least one approval, no pending requests for changes, and a CI started. needs-ci PRs that need a full CI run. v8 engine Issues and PRs related to the V8 dependency.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

"deserializer.readDouble()" results in an abort
5 participants
@cjihrig @gengjiawen @nodejs-github-bot @jasnell @RaisinTen