search

rubyjs / therubyracer

Embed the V8 Javascript Interpreter into Ruby
1.67k stars 190 forks source link

security hardening bug - stack clash attacks #451

Open victorsosa opened 5 years ago

victorsosa commented 5 years ago

This is a priority bug: The C++ standard library hardening may detect some invalid out-of-bounds access which have gone unnoticed before.

Compile all binaries with stack clash protection (-fstack-clash-protection). As a result, attempts to jump the stack guard (a requirement for stack clash attacks) will reliably result in a crash rather than giving the attacker control over stack/heap objects.

check link for more details: https://stackoverflow.com/questions/51661931/rails-s-command-issue/51662528#51662528

so now that the libstdc++ 8.1 is checking with assertions ON. Making this lib compatible with version >8.1 libstdc++

victorsosa commented 5 years ago

NEW Release as soon as possible

victorsosa commented 4 years ago

any progress on this?