Skip to content

Commit 35ee505

Browse files
Meghana Guptaakroshg
authored andcommitted
CVE-2019-0810 Type Confusion with DeleteElemI_A & DeleteElemIStrict_A - 360Vulcan
1 parent a6f5a53 commit 35ee505

File tree

1 file changed

+10
-3
lines changed

1 file changed

+10
-3
lines changed

lib/Backend/GlobOptFields.cpp

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,17 @@ GlobOpt::KillLiveElems(IR::IndirOpnd * indirOpnd, BVSparse<JitArenaAllocator> *
237237
this->KillAllFields(bv); // This also kills all property type values, as the same bit-vector tracks those stack syms
238238
SetAnyPropertyMayBeWrittenTo();
239239
}
240-
else if (inGlobOpt && indexOpnd && !indexOpnd->GetValueType().IsInt() && !currentBlock->globOptData.IsInt32TypeSpecialized(indexOpnd->m_sym))
240+
else if (inGlobOpt)
241241
{
242-
// Write/delete to a non-integer numeric index can't alias a name on the RHS of a dot, but it change object layout
243-
this->KillAllObjectTypes(bv);
242+
Value * indexValue = indexOpnd ? this->currentBlock->globOptData.FindValue(indexOpnd->GetSym()) : nullptr;
243+
ValueInfo * indexValueInfo = indexValue ? indexValue->GetValueInfo() : nullptr;
244+
int indexLowerBound = 0;
245+
246+
if (indirOpnd->GetOffset() < 0 || (indexOpnd && (!indexValueInfo || !indexValueInfo->TryGetIntConstantLowerBound(&indexLowerBound, false) || indexLowerBound < 0)))
247+
{
248+
// Write/delete to a non-integer numeric index can't alias a name on the RHS of a dot, but it change object layout
249+
this->KillAllObjectTypes(bv);
250+
}
244251
}
245252
}
246253

0 commit comments

Comments
 (0)