4 ms·

node.js doesn't share any code with nginx

• thepumpkin1979 15y ago
  Nginx and Node have totally separate http parsers, may be Node uses some code( like https://github.com/joyent/libuv/blob/master/include/uv-private/ngx-queue.h https://github.com/joyent/libuv/blob/master/include/uv-priva...) but nothing related to this issue.
• IsaacSchlueter 15y ago
  That's not quite true. The http-parser library has some bits lifted from nginx. Node itself, however, does not, and the bug is not quite the same as the nginx bug (though they do have a lot of words in common: attacker, request, carefully-crafted, etc. ;P
  • jahewson 15y ago
    Ah I see. Thanks I missed it there in the /deps directory, I just followed the link to a node C++ file in the commit in question.
  • tptacek 15y ago
    The impact of the bug is the same, and it's an idiosyncratic kind of memory corruption bug, which is why I thought the original flaw might have been inherited. Thanks for clearing it up.
    • aaronblohowiak 15y ago
      s/corruption/information leak
      • tptacek 15y ago
        To my mind the exact same class of bugs, but you're not wrong to clarify. It's a particularly bad breed of "disclosure".