src: call V8::ExternalMemoryAccounter::Update instead of V8::ExternalMemoryAccounter::Increase to report memory difference to V8
#59623
+2
−2
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Review requested:
|
nodejs-github-bot
added
c++
Call `V8::ExternalMemoryAccounter::Update` instead of `V8::ExternalMemoryAccounter::Increase` to report memory difference to V8 Calling `V8::ExternalMemoryAccounter::Increase` with a signed integer on 32-bit platforms causes instances where GC inside GC takes place leading to a crash in certain cases. During GC, native objects are destructed. In destructor for `CompressionStream` class used by zlib, memory release information is passed onto `V8::ExternalMemoryAccounter::Increase()` instead of `V8::ExternalMemoryAccounter::Decrease()` which triggers V8's memory limits, thus triggering GC inside GC which leads to crash. Bug initially introduced in commit 1d5d7b6 For full report see https://hackerone.com/reports/3302484
thunder-coding
force-pushed
the
hackerone-3302484
branch
from
33e25b6 to
9d77c41
Compare
thunder-coding
added a commit
to termux/termux-packages
that referenced
this pull request
Aug 25, 2025
zlib.createDeflate().write() The plan was to do a coordinated disclosure with upstream as it is a crash that was happening on all 32-bit Linux binaries, but upstream is not willing to block releases for failures for 32-bit Linux, so we'll have to go ahead and patch this ourselves. The fix has also been sent upstream as in nodejs/node#59623 Full writeup of the security report can be found on https://hackerone.com/reports/3302484 Closes #25455
termux-pacman-bot
added a commit
to termux-pacman/termux-packages
that referenced
this pull request
Aug 25, 2025
zlib.createDeflate().write() The plan was to do a coordinated disclosure with upstream as it is a crash that was happening on all 32-bit Linux binaries, but upstream is not willing to block releases for failures for 32-bit Linux, so we'll have to go ahead and patch this ourselves. The fix has also been sent upstream as in nodejs/node#59623 Full writeup of the security report can be found on https://hackerone.com/reports/3302484 Closes termux/termux-packages#25455
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #59623 +/- ##
==========================================
- Coverage 89.84% 89.83% -0.02%
==========================================
Files 667 667
Lines 196260 196260
Branches 38563 38562 -1
==========================================
- Hits 176332 176310 -22
- Misses 12382 12416 +34
+ Partials 7546 7534 -12
🚀 New features to boost your workflow:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Calling
V8::ExternalMemoryAccounter::Increasewith a signed integer on32-bit platforms causes instances where GC inside GC takes place leading
to a crash in certain cases.
During GC, native objects are destructed. In destructor for
CompressionStreamclass used by zlib, memory release information ispassed onto
V8::ExternalMemoryAccounter::Increase()instead ofV8::ExternalMemoryAccounter::Decrease()which triggers V8's memorylimits, thus triggering GC inside GC which leads to crash.
Bug initially introduced in commit
1d5d7b6
For full report see https://hackerone.com/reports/3302484