Skip to content

Conversation

rhuanjl
Copy link
Collaborator

@rhuanjl rhuanjl commented Oct 22, 2022

CharTrie::CloneFrom uses recursion to clone a CharTrie tree. Currently this can overflow the native stack producing an uncatchable hard crash.

Fix by inserting a PROBE_STACK call that checks sufficient stack space is left and throws a catchable JS exception if not.

Bug reported by @bjrjk

Fix #6835

@rhuanjl rhuanjl assigned rhuanjl and unassigned rhuanjl Oct 22, 2022
@rhuanjl rhuanjl requested a review from ppenzin October 22, 2022 10:41
ShortDevelopment added a commit to ShortDevelopment/ChakraCore that referenced this pull request Oct 22, 2022
@ppenzin ppenzin merged commit a9850e2 into chakra-core:master Nov 2, 2022
@rhuanjl rhuanjl deleted the FixCharTrieClone branch February 10, 2023 08:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Construct a specific payload to [String].match cause ChakraCore engine StackOverflow crash, which may cause denial of service.
2 participants