Luke Wilde 5146bbe296 LibGC: Visit the edges of the cells that must survive garbage collection ... Previously, we would only keep the cell that must survive alive, but none of it's edges. This cropped up with a GC UAF in must_survive_garbage_collection of WebSocket in .NET's SignalR frontend implementation, where an out-of-scope WebSocket had it's underlying EventTarget properties garbage collected, and must_survive_garbage_collection read from the destroyed EventTarget properties. See: https://github.com/dotnet/aspnetcore/blob/main/src/SignalR/clients/ts/signalr/src/WebSocketTransport.ts#L81 Found on https://www.formula1.com/ during a live session. Co-Authored-By: Tim Flynn <trflynn89@pm.me>		2025-02-27 14:35:28 -05:00
..
echo.txt
WebSocket-gc.txt	LibGC: Visit the edges of the cells that must survive garbage collection	2025-02-27 14:35:28 -05:00