Skip to content

Commit 6104092

Browse files
thunder-codingptrcnull
authored andcommitted
community/nodejs-current: fix crashes for zlib on 32-bit architectures
This happens due to incorrect V8 API usage leading to GC inside GC. Full report can be found on https://hackerone.com/reports/3302484 Bug originally reported over on termux/termux-packages#25455 Patch submitted upstream as well: nodejs/node#59623
1 parent 8ff6bf2 commit 6104092

File tree

2 files changed

+60
-1
lines changed

2 files changed

+60
-1
lines changed

community/nodejs-current/APKBUILD

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@
7676
pkgname=nodejs-current
7777
# The current stable version, i.e. non-LTS.
7878
pkgver=24.7.0
79-
pkgrel=0
79+
pkgrel=1
8080
pkgdesc="JavaScript runtime built on V8 engine - current stable version"
8181
url="https://nodejs.org/"
8282
arch="all"
@@ -110,6 +110,7 @@ source="https://nodejs.org/dist/v$pkgver/node-v$pkgver.tar.xz
110110
v8-disable-trap-handler-on-riscv-sv39.patch
111111
v8-int64-lowering-reducer.patch
112112
v8-ppc_vsx-inl.patch
113+
fix-32bit-zlib-crashes.patch
113114
"
114115
builddir="$srcdir/node-v$pkgver"
115116

@@ -167,4 +168,5 @@ aee447854f4055e68104fcf5bd4c05f7c2a607961cb0735afdd3d356c96a9568ff2f6dd5aac46428
167168
be11f111280f2f8af99dfdd56d23a5929bc77a19575d6166847ef31af9c1c79f65ba591644e15b95a35ff8dc763486d63b64825be71eb455eb0c90830a0c8092 v8-disable-trap-handler-on-riscv-sv39.patch
168169
01487d19f2478be25a4a75c01de344140eee8e07aec66235542dcf45731f9588aa64b9b5f8635d37b8d3aa53065e1654aeb3aab2dc9b15ce87e102c39e8281a9 v8-int64-lowering-reducer.patch
169170
7d0ca5d20f24372dc56b3f05d3e7fa603abf9651d1945c631617893af8d2c0379f743ed77f99d6b658e34a5e11361ba71f3b44abd34d45cd9d38269162cace6a v8-ppc_vsx-inl.patch
171+
85599acd40cc12fa2405e531072296d2f1b2f3d8fa60dac8f76aa95f4b1560fdbd0cef81c9266ee9d7fc2c213b8f7320c35c07ae66a0f4dc75ce7ce75297c08f fix-32bit-zlib-crashes.patch
170172
"
Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
From 9d77c4191030576fd502faa04148b52fa6dbcb43 Mon Sep 17 00:00:00 2001
2+
From: Yaksh Bariya <yakshbari4@gmail.com>
3+
Date: Mon, 25 Aug 2025 14:19:59 +0530
4+
Subject: [PATCH] src: correctly report memory changes to V8
5+
6+
Call `V8::ExternalMemoryAccounter::Update` instead of
7+
`V8::ExternalMemoryAccounter::Increase` to report memory difference to
8+
V8
9+
10+
Calling `V8::ExternalMemoryAccounter::Increase` with a signed integer on
11+
32-bit platforms causes instances where GC inside GC takes place leading
12+
to a crash in certain cases.
13+
14+
During GC, native objects are destructed. In destructor for
15+
`CompressionStream` class used by zlib, memory release information is
16+
passed onto `V8::ExternalMemoryAccounter::Increase()` instead of
17+
`V8::ExternalMemoryAccounter::Decrease()` which triggers V8's memory
18+
limits, thus triggering GC inside GC which leads to crash.
19+
20+
Bug initially introduced in commit
21+
1d5d7b6eedb2274c9ad48b5f378598a10479e4a7
22+
23+
For full report see https://hackerone.com/reports/3302484
24+
---
25+
src/node_mem-inl.h | 2 +-
26+
src/node_zlib.cc | 2 +-
27+
2 files changed, 2 insertions(+), 2 deletions(-)
28+
29+
diff --git a/src/node_mem-inl.h b/src/node_mem-inl.h
30+
index 06871d031d3..70d28dd524b 100644
31+
--- a/src/node_mem-inl.h
32+
+++ b/src/node_mem-inl.h
33+
@@ -59,7 +59,7 @@ void* NgLibMemoryManager<Class, T>::ReallocImpl(void* ptr,
34+
// Environment*/Isolate* parameter and call the V8 method transparently.
35+
const int64_t new_size = size - previous_size;
36+
manager->IncreaseAllocatedSize(new_size);
37+
- manager->env()->external_memory_accounter()->Increase(
38+
+ manager->env()->external_memory_accounter()->Update(
39+
manager->env()->isolate(), new_size);
40+
*reinterpret_cast<size_t*>(mem) = size;
41+
mem += sizeof(size_t);
42+
diff --git a/src/node_zlib.cc b/src/node_zlib.cc
43+
index c088c547539..b8617093bdf 100644
44+
--- a/src/node_zlib.cc
45+
+++ b/src/node_zlib.cc
46+
@@ -644,7 +644,7 @@ class CompressionStream : public AsyncWrap, public ThreadPoolWork {
47+
if (report == 0) return;
48+
CHECK_IMPLIES(report < 0, zlib_memory_ >= static_cast<size_t>(-report));
49+
zlib_memory_ += report;
50+
- AsyncWrap::env()->external_memory_accounter()->Increase(
51+
+ AsyncWrap::env()->external_memory_accounter()->Update(
52+
AsyncWrap::env()->isolate(), report);
53+
}
54+
55+
--
56+
2.51.0
57+

0 commit comments

Comments
 (0)