4 ms·

PoC is in codebase, it was published as a test-case for the fix.

• jkrems 13y ago
  Unfortunately that test-case passes against 0.8.25 as well. So I'm not quite convinced it can be used reliably to reproduce the problem.
  • ak217 13y ago
    Unsurprising because the new streams API, which is responsible for this bug, was introduced in node 0.10. Try with earlier 0.10 versions instead.
    • jkrems 13y ago
      Well, in that case lets add confusion about affected versions to the list of things being suboptimal about this whole thing: http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/ http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/ - the same warning about the same error and they did backport the fix to 0.8: https://github.com/joyent/node/commit/653d4db71f569ddc87a0bc21f5ecc5ceaf37f932 https://github.com/joyent/node/commit/653d4db71f569ddc87a0bc...
      • ak217 13y ago
        You're right, that is confusing. I'm not sure how it's exploitable in 0.8.