CVE-2019-0812

pleath · akroshg · commit 4cb3bbd332f6 · 2019-04-08T10:26:41.000-07:00
diff --git a/lib/Runtime/Types/DictionaryTypeHandler.cpp b/lib/Runtime/Types/DictionaryTypeHandler.cpp
@@ -139,7 +139,7 @@ namespace Js
                 PropertyString* propertyString = scriptContext->GetPropertyString(*propertyId);
                 *propertyStringName = propertyString;
                 T dataSlot = descriptor.template GetDataPropertyIndex<false>();
-                if (dataSlot != NoSlots && (attribs & PropertyWritable))
+                if (dataSlot != NoSlots && (attribs & PropertyWritable) && type == typeToEnumerate)
                 {
                     PropertyValueInfo::SetCacheInfo(info, propertyString, propertyString->GetLdElemInlineCache(), false);
                     SetPropertyValueInfo(info, instance, dataSlot, &descriptor);
diff --git a/lib/Runtime/Types/SimpleTypeHandler.cpp b/lib/Runtime/Types/SimpleTypeHandler.cpp
@@ -328,7 +328,7 @@ namespace Js
                 *propertyStringName = propStr;
 
                 PropertyValueInfo::SetCacheInfo(info, propStr, propStr->GetLdElemInlineCache(), false);
-                if ((attribs & PropertyWritable) == PropertyWritable)
+                if ((attribs & PropertyWritable) == PropertyWritable && type == typeToEnumerate)
                 {
                     PropertyValueInfo::Set(info, instance, index, attribs);
                 }

Original file line number	Diff line number	Diff line change
`@@ -139,7 +139,7 @@ namespace Js`
`139`	`139`	`PropertyString* propertyString = scriptContext->GetPropertyString(*propertyId);`
`140`	`140`	`*propertyStringName = propertyString;`
`141`	`141`	`T dataSlot = descriptor.template GetDataPropertyIndex<false>();`
`142`		`- if (dataSlot != NoSlots && (attribs & PropertyWritable))`
	`142`	`+ if (dataSlot != NoSlots && (attribs & PropertyWritable) && type == typeToEnumerate)`
`143`	`143`	`{`
`144`	`144`	`PropertyValueInfo::SetCacheInfo(info, propertyString, propertyString->GetLdElemInlineCache(), false);`
`145`	`145`	`SetPropertyValueInfo(info, instance, dataSlot, &descriptor);`
Original file line number	Diff line number	Diff line change
`@@ -328,7 +328,7 @@ namespace Js`
`328`	`328`	`*propertyStringName = propStr;`
`329`	`329`
`330`	`330`	`PropertyValueInfo::SetCacheInfo(info, propStr, propStr->GetLdElemInlineCache(), false);`
`331`		`- if ((attribs & PropertyWritable) == PropertyWritable)`
	`331`	`+ if ((attribs & PropertyWritable) == PropertyWritable && type == typeToEnumerate)`
`332`	`332`	`{`
`333`	`333`	`PropertyValueInfo::Set(info, instance, index, attribs);`
`334`	`334`	`}`