diff --git a/common.gypi b/common.gypi index 5e6383ab3cc44d..ba6b791a6ccf82 100644 --- a/common.gypi +++ b/common.gypi @@ -36,7 +36,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.8', + 'v8_embedder_string': '-node.9', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc index 4ecf4832989292..246281e4e2b44b 100644 --- a/deps/v8/src/objects/value-serializer.cc +++ b/deps/v8/src/objects/value-serializer.cc @@ -1190,7 +1190,8 @@ Maybe ValueDeserializer::ReadZigZag() { Maybe ValueDeserializer::ReadDouble() { // Warning: this uses host endianness. - if (position_ > end_ - sizeof(double)) return Nothing(); + if (sizeof(double) > static_cast(end_ - position_)) + return Nothing(); double value; base::Memcpy(&value, position_, sizeof(double)); position_ += sizeof(double); diff --git a/test/parallel/test-v8-serdes.js b/test/parallel/test-v8-serdes.js index 2ccfc9943a9175..1d3b6ff81168e7 100644 --- a/test/parallel/test-v8-serdes.js +++ b/test/parallel/test-v8-serdes.js @@ -236,3 +236,10 @@ const hostObject = new (internalBinding('js_stream').JSStream)(); /^TypeError: buffer must be a TypedArray or a DataView$/, ); } + +{ + // Regression test for https://github.com/nodejs/node/issues/37978 + assert.throws(() => { + new v8.Deserializer(new v8.Serializer().releaseBuffer()).readDouble(); + }, /ReadDouble\(\) failed/); +}