v6.6.0 node::PBKDF2() Out of Memory

[scttcper]

The following code crashes in v6.6.0 on OSX 10.11.6. v6.5.0 does not crash.

running

var crypto = require('crypto');
var salt = new Buffer('McWpw6FL29zJ6E97Le3hKQ==', 'base64');
crypto.pbkdf2('', salt, 1, 32, "sha256", function(error, saltedPassword) {
  console.log(error);
  console.log(saltedPassword);
});

results in

FATAL ERROR: node::PBKDF2() Out of Memory
 1: node::Abort() [/Users/scoope7/.nvm/versions/node/v6.6.0/bin/node]
 2: node::FatalException(v8::Isolate*, v8::Local<v8::Value>, v8::Local<v8::Message>) [/Users/scoope7/.nvm/versions/node/v6.6.0/bin/node]
 3: node::ClearFatalExceptionHandlers(node::Environment*) [/Users/scoope7/.nvm/versions/node/v6.6.0/bin/node]
 4: node::crypto::RandomBytesWork(uv_work_s*) [/Users/scoope7/.nvm/versions/node/v6.6.0/bin/node]
 5: v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&)) [/Users/scoope7/.nvm/versions/node/v6.6.0/bin/node]
 6: v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) [/Users/scoope7/.nvm/versions/node/v6.6.0/bin/node]
 7: v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) [/Users/scoope7/.nvm/versions/node/v6.6.0/bin/node]
 8: 0xe4335f092a7
[1]    45139 abort      node crash.js

This was code extracted out of https://github.com/neumino/rethinkdbdash that was crashing a project.

[not-an-aardvark]

I was able to reproduce this on OSX 10.11.6.

[MarkHerhold]

@scttcper Thanks for reporting this! I just hit the same issue in my project which also uses rethinkdbdash, so I assume the issue is the same.

[mscdex]

Confirmed on Linux as well.

[not-an-aardvark]

It's possible a00ccb0 is the cause, I'll bisect to verify.

[mscdex]

I can confirm that reverting a00ccb0 fixes it.

/cc @mhdawson @addaleax @bnoordhuis

[mscdex]

I think we may need to add a length check for every nullptr check, like what was done in ed640ae? It seems like there are many uses of node::Malloc() without that extra check.

[Trott]

I think we may need to add a length check for every nullptr check, like what was done in ed640ae?

Sure seems like that change set needs to be gone over to find nullptr checks that might be affected.

As far as the specific issue here, test case and proposed fix at #8572

[niieani]

I'm also getting a crash when running tsc compilation (TypeScript) with 6.6.0. It works with 6.5.0. Not sure if it's the same error though.

[not-an-aardvark]

@niieani, would you mind posting the stack trace of the tsc crash (assuming there is a stack trace)? This will help us triage the issue to figure out if it's the same one, or create a new fix if not.

[ghiscoding]

I can also confirm that reverting back to NodeJS v6.5 fixes the problem (running on Win10). I will stick with 6.5 until resolution.