Skip to content

Commit 62a0e08

Browse files
legendecasaduh95
authored andcommitted
src: fix startup snapshot reproducibility of InternalFieldInfo
`memset` before a placement `new` can be optimized away by GCC due to lifetime analysis. This causes the buffer in the startup snapshot vulnerable to ASLR. Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net> PR-URL: #65684 Fixes: #65508 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 7623913 commit 62a0e08

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

src/node_snapshotable.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,11 @@ struct InternalFieldInfoBase {
4444
template <std::derived_from<InternalFieldInfoBase> T>
4545
static T* New(EmbedderObjectType type) {
4646
void* buf = ::operator new[](sizeof(T));
47-
memset(buf, 0, sizeof(T)); // Make the padding reproducible.
4847
T* result = new (buf) T;
48+
// Zero the padding to make the bytes handed to V8 reproducible. Must come
49+
// after the placement new, or -flifetime-dse drops it as a dead store.
50+
// https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fno-lifetime-dse
51+
memset(static_cast<void*>(result), 0, sizeof(T));
4952
result->type = type;
5053
result->length = sizeof(T);
5154
return result;

0 commit comments

Comments
 (0)