Skip to content

Commit 2203ac9

Browse files
legendecasaduh95
authored andcommitted
src: fix startup snapshot reproducibility of InternalFieldInfo
`memset` before a placement `new` can be optimized away by GCC due to lifetime analysis. This causes the buffer in the startup snapshot vulnerable to ASLR. Signed-off-by: Chengzhong Wu <[email protected]> PR-URL: #65684 Fixes: #65508 Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Richard Lau <[email protected]>
1 parent c2bb3ae commit 2203ac9

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

‎src/node_snapshotable.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,11 @@ struct InternalFieldInfoBase {
4747
std::is_same_v<InternalFieldInfoBase, T>,
4848
"Can only accept InternalFieldInfoBase subclasses");
4949
void* buf = ::operator new[](sizeof(T));
50-
memset(buf, 0, sizeof(T)); // Make the padding reproducible.
5150
T* result = new (buf) T;
51+
// Zero the padding to make the bytes handed to V8 reproducible. Must come
52+
// after the placement new, or -flifetime-dse drops it as a dead store.
53+
// https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fno-lifetime-dse
54+
memset(static_cast<void*>(result), 0, sizeof(T));
5255
result->type = type;
5356
result->length = sizeof(T);
5457
return result;

0 commit comments

Comments
 (0)