codex/propose-fix-for-use-after-free-vulnerability - Branch - cloudflare/workerd

Restore strong captures in internal stream read callbacks to prevent UAF

#6202Merged

Comparing

codex/propose-fix-for-use-after-free-vulnerability

(

5014790

) with

main

(

24a00c8

)

Untouched: 70

Skipped: 129

Benchmarks

199 total

arrayBufferBody[Response]

src/workerd/tests/bench-response.c++

+1%

17.7 µs17.6 µs

nullBodyWithStatus[Response]

src/workerd/tests/bench-response.c++

+1%

10.4 µs10.4 µs

simpleStringBody[Response]

src/workerd/tests/bench-response.c++

20.2 µs20.1 µs

constructor[ApiHeaders]

src/workerd/tests/bench-api-headers.c++

67.8 ms67.7 ms

jsonResponse[Response]

src/workerd/tests/bench-response.c++

40.2 µs40.1 µs

bodyWithHeaders[Response]

src/workerd/tests/bench-response.c++

30.3 µs30.2 µs

request[RegExpBenchmark]

src/workerd/tests/bench-regex.c++

8.2 ms8.2 ms

Test_JSON_DEC

src/workerd/tests/bench-json.c++

3.2 s3.2 s

bm_Http_OverCapnpLocalCall

external/+http+capnp-cpp/src/capnp/compat/http-over-capnp-bench.c++

128.2 µs128.2 µs

EncodeInto_ASCII_1024[TextEncoder][1/0/1024]

src/workerd/tests/bench-text-encoder.c++

2.5 ms2.5 ms

EncodeInto_OneByte_8192[TextEncoder][1/1/8192]

src/workerd/tests/bench-text-encoder.c++

66.5 ms66.5 ms

bm_Http_OverCapnpFullRPC

external/+http+capnp-cpp/src/capnp/compat/http-over-capnp-bench.c++

234.9 µs234.9 µs

JsString_Utf8Length_Utf16_Invalid_NonFlat_8192

src/workerd/tests/bench-jsstring.c++

74.1 µs74.1 µs

JsString_Utf8Length_Utf16_Invalid_NonFlat_256

src/workerd/tests/bench-jsstring.c++

9.3 µs9.3 µs

Parse[KjHeaders]

src/workerd/tests/bench-kj-headers.c++

44.2 µs44.2 µs

bm_Http_Baseline

external/+http+capnp-cpp/src/capnp/compat/http-over-capnp-bench.c++

11.1 µs11.1 µs

bm_Http_ClientWrapper

external/+http+capnp-cpp/src/capnp/compat/http-over-capnp-bench.c++

35.8 µs35.8 µs

JsString_Utf8Length_Utf16_NonFlat_1024

src/workerd/tests/bench-jsstring.c++

10.3 µs10.3 µs

JsString_Utf8Length_Utf16_NonFlat_8192

src/workerd/tests/bench-jsstring.c++

24.7 µs24.7 µs

JsString_Utf8Length_Utf16_NonFlat_256

src/workerd/tests/bench-jsstring.c++

8.2 µs8.2 µs

Serialize

src/workerd/tests/bench-mimetype.c++::Mimetype

74.6 ms74.6 ms

bm_Coro_Immediate

external/+http+capnp-cpp/src/kj/async-bench.c++

4.3 µs4.3 µs

ParseAndSerialize

src/workerd/tests/bench-mimetype.c++::Mimetype

74.8 ms74.8 ms

bm_Coro_CoAwait_ImmediateCoroutine

external/+http+capnp-cpp/src/kj/async-bench.c++

6 µs6 µs

bm_Promise_Immediate

external/+http+capnp-cpp/src/kj/async-bench.c++

3.6 µs3.6 µs

Commits

Click on a commit to change the comparison range

Base

main

24a00c8

+0.02%

Fix internal stream read callbacks lifetime capture

5014790

2 months ago

by dknecht

Home Terms Privacy Docs