CWE-195 in ExternalMemoryAccounter::Increase()
该报告还没有中文解读。
原文摘录
摘自原文(5005 字符中的一小部分)
V8's `ExternalMemoryAccounter::Increase()` expects an unsigned `size_t` argument, but a signed `ssize_t` which in some cases results in garbage collection to happen during garbage collection. Here's a simplified version of what happens (full backtrace has been attached in the issue):
原文中的代码
v8::internal::Heap::CollectAllGarbage GC triggered by as negative integer passed to v8::ExternalMemoryAccounter::Increase(v8::Isolate*, unsigned int) called by node::(anonymous namespace)::CompressionStream<node::(anonymous namespace)::ZlibContext>::Close() during destruction of node::(anonymous …
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Node.js 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @codingthunder · 版权归作者与 Node.js 所有