[CVE-2018-0939] Edge - chakra arguments bug version 2.0 - Individual

agarwal-sandeep · akroshg · commit 090277e7a5ea · 2018-03-12T11:58:24.000-07:00
Object destructuring should track assignment in case of default value
diff --git a/lib/Parser/Parse.cpp b/lib/Parser/Parse.cpp
@@ -12904,6 +12904,10 @@ ParseNodePtr Parser::GetRightSideNodeFromPattern(ParseNodePtr pnode)
         {
             TrackAssignment<true>(pnode, nullptr);
         }
+        else if (op == knopAsg)
+        {
+            TrackAssignment<true>(pnode->sxBin.pnode1, nullptr);
+        }
     }
 
     return rightNode;

Original file line number	Diff line number	Diff line change
`@@ -12904,6 +12904,10 @@ ParseNodePtr Parser::GetRightSideNodeFromPattern(ParseNodePtr pnode)`
`12904`	`12904`	`{`
`12905`	`12905`	`TrackAssignment<true>(pnode, nullptr);`
`12906`	`12906`	`}`
	`12907`	`+ else if (op == knopAsg)`
	`12908`	`+ {`
	`12909`	`+ TrackAssignment<true>(pnode->sxBin.pnode1, nullptr);`
	`12910`	`+ }`
`12907`	`12911`	`}`
`12908`	`12912`
`12909`	`12913`	`return rightNode;`