Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Snapshot.load accepts a blob from another V8 version, and Context.new then kills the process

Cerrado
  • ¿Algo no está bien?
#448 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript, ruby
Área
backend, security

Línea de trabajo

Read ext/mini_racer_extension/mini_racer_extension.c around snapshot_load and ext/mini_racer_extension/mini_racer_v8.cc around v8_thread_init, where the blob reaches v8::Isolate::New. Check V8 snapshot header length and section offsets before V8 uses the data, including the truncated-tail case. Done means incompatible or malformed blobs raise MiniRacer::SnapshotError instead of terminating the process; add focused coverage for both reproductions.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Snapshot.load accepts an incompatible snapshot blob, then Context.new terminates the process inside V8. This affects trusted snapshots persisted across upgrades that change libv8-node.

Reproduce
require "mini_racer"

blob = MiniRacer::Snapshot.new("var a = 1").dump.dup
blob.setbyte(16, blob.getbyte(16) ^ 1)
MiniRacer::Context.new(snapshot: MiniRacer::Snapshot.load(blob))
puts "not reached"

Byte 16 is the first byte of the version string in V8 13.6's snapshot header, so flipping it stands in for a blob saved by a different libv8-node.

What happens
#
# Fatal error in , line 0
# Version mismatch between V8 binary and snapshot.
#   V8 binary version: 13.6.233.17-node.37
#    Snapshot version: 03.6.233.17-node.37
# The snapshot consists of 410911 bytes and contains 1 context(s).

Exit status 133 (SIGTRAP), followed by a native backtrace.

Cutting the last 16 bytes from the blob instead produces no message and exits with status 139 (SIGSEGV). Both cases reproduced in 3 of 3 runs.

Expected

Snapshot.load or Context.new should raise MiniRacer::SnapshotError when the current V8 cannot use the blob.

Cause

snapshot_load only duplicates the supplied String (ext/mini_racer_extension/mini_racer_extension.c:2152, ext/mini_racer_extension/mini_racer_extension.c:2160). v8_thread_init passes the blob to v8::Isolate::New without validating it (ext/mini_racer_extension/mini_racer_v8.cc:451, ext/mini_racer_extension/mini_racer_v8.cc:456). V8 handles a version mismatch with FATAL and invalid section offsets with CHECK, so malformed or stale data ends the process.

Possible fix

Check that the blob is longer than the header, then call v8::StartupData::IsValid() and raise SnapshotError on failure. The length check must come first because IsValid() checks the header bounds fatally. A truncated tail also needs bounds validation for the section offsets because V8 verifies the checksum only in debug builds.

Related: closed PR #101 discussed a version mismatch abort in 2018.

Environment
  • mini_racer 0.22.1 with libv8-node 24.12.0.1 (V8 13.6.233.17-node.37)
  • Ruby 3.4.2 x86_64-linux
  • Fedora 44

Reproduced in 3 of 3 runs.

Lenguaje dominante
JavaScript
Estrellas
628
Forks
100
Merge medio
1 d 20 h
PR fusionados (30 d)
2

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de rubyjs/mini_racer

Todos los issues de rubyjs/mini_racer

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.