Backport of CVE 2024 22019 for v14.x #1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original fix for v18: nodejs@03a5c34 On top of the v18 patch, we needed to initialize the rest of callbacks in order to avoid warnings like ../src/node_http_parser.cc:967:1: warning: missing initializer for member 'llhttp_settings_s::on_header_value_complete' [-Wmissing-field-initializers]
This change is related to nodejs/llhttp@015e155 that replaced a single llhttp_set_lenient with more granular calls. However, we only have lenient bool, so set it all or none.
|
I'm very wary about updating llhttp from 2.1.6 to 6.1.0 -- I think the failing tests indicates that there might be breaking changes there (maybe related to nodejs#38146 (comment)). I've opened an alternative #3 where I've attempted to backport the feature used by nodejs@911cb33 onto the llhttp |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Original fix for v18:
nodejs@03a5c34
On top of the v18 patch, we needed to initialize the rest of callbacks in order to avoid warnings like
Replace llhttp_set_lenient with llhttp_set_lenient_*variants
This change is related to nodejs/llhttp@015e155 that replaced a single llhttp_set_lenient with more granular calls.
However, we only have lenient bool, so set it all or none.