[CVE-2018-8503] Edge - RCE :Type Confusion Bug For Edge Bounty Program - Qihoo 360

rajatd · Thomas Moore (CHAKRA) · commit 062b4d9f4272 · 2018-10-08T11:29:11.000-07:00
diff --git a/lib/Runtime/Library/JavascriptArray.cpp b/lib/Runtime/Library/JavascriptArray.cpp
@@ -1499,13 +1499,11 @@ using namespace Js;
 
             bool isTaggedInt = TaggedInt::Is(item);
             bool isTaggedIntMissingValue = false;
-#ifdef TARGET_64
             if (isTaggedInt)
             {
                 int32 iValue = TaggedInt::ToInt32(item);
                 isTaggedIntMissingValue = Js::SparseArraySegment<int32>::IsMissingItem(&iValue);
             }
-#endif
             if (isTaggedInt && !isTaggedIntMissingValue)
             {
                 // This is taggedInt case and we verified that item is not missing value in AMD64.

Original file line number	Diff line number	Diff line change
`@@ -1499,13 +1499,11 @@ using namespace Js;`
`1499`	`1499`
`1500`	`1500`	`bool isTaggedInt = TaggedInt::Is(item);`
`1501`	`1501`	`bool isTaggedIntMissingValue = false;`
`1502`		`-#ifdef TARGET_64`
`1503`	`1502`	`if (isTaggedInt)`
`1504`	`1503`	`{`
`1505`	`1504`	`int32 iValue = TaggedInt::ToInt32(item);`
`1506`	`1505`	`isTaggedIntMissingValue = Js::SparseArraySegment<int32>::IsMissingItem(&iValue);`
`1507`	`1506`	`}`
`1508`		`-#endif`
`1509`	`1507`	`if (isTaggedInt && !isTaggedIntMissingValue)`
`1510`	`1508`	`{`
`1511`	`1509`	`// This is taggedInt case and we verified that item is not missing value in AMD64.`