4 ms·
That's not quite true. The http-parser library has some bits lifted from nginx. Node itself, however, does not, and the bug is not quite the same as the nginx
by IsaacSchlueter 14y ago
That's not quite true. The http-parser library has some bits lifted from nginx. Node itself, however, does not, and the bug is not quite the same as the nginx bug (though they do have a lot of words in common: attacker, request, carefully-crafted, etc. ;P
- jahewson 14y agoAh I see. Thanks I missed it there in the /deps directory, I just followed the link to a node C++ file in the commit in question.
- tptacek 14y agoThe impact of the bug is the same, and it's an idiosyncratic kind of memory corruption bug, which is why I thought the original flaw might have been inherited. Thanks for clearing it up.
- aaronblohowiak 14y agos/corruption/information leak
- tptacek 14y agoTo my mind the exact same class of bugs, but you're not wrong to clarify. It's a particularly bad breed of "disclosure".