joyent/node — pull request #6699 by tchollingsworth (2013-12-13 21:51:58+00:00)
Title: v8: backport fix for CVE-2013-6639 and CVE-2013-6640 (v0.10)

Quoting CVE-2013-6639:

The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before
3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote
attackers to cause a denial of service (out-of-bounds write) or possibly
have unspecified other impact via JavaScript code that sets the value of an
array element with a crafted index.

Quoting CVE-2013-6640:

The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before
3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote
attackers to cause a denial of service (out-of-bounds read) via JavaScript
code that sets a variable to the value of an array element with a crafted
index.

Like 6b92a7, this is unlikely to affect node.js because it only runs local,
trusted code. However, if there exists some module somewhere that populates
an array index with remotely provided data this could very well be used to crash
a remote server running node. Defense in depth and all.

This is a backport of upstream commit r17801. Original commit log:

Limit size of dehoistable array indices

LOG=Y
BUG=chromium:319835,chromium:319860
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/74113002