[CVE-2018-8227] Edge - Bad input to JIT process causes OOB write - Internal

MikeHolman · leirocks · commit 8af718902bfd · 2018-06-11T11:09:14.000-07:00
diff --git a/lib/Backend/Func.cpp b/lib/Backend/Func.cpp
@@ -262,7 +262,7 @@ Func::Func(JitArenaAllocator *alloc, JITTimeWorkItem * workItem,
         ObjTypeSpecFldInfo * info = GetWorkItem()->GetJITTimeInfo()->GetObjTypeSpecFldInfo(i);
         if (info != nullptr)
         {
-            Assert(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());
+            AssertOrFailFast(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());
             GetTopFunc()->m_globalObjTypeSpecFldInfoArray[info->GetObjTypeSpecFldId()] = info;
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -262,7 +262,7 @@ Func::Func(JitArenaAllocator alloc, JITTimeWorkItem workItem,`
`262`	`262`	`ObjTypeSpecFldInfo * info = GetWorkItem()->GetJITTimeInfo()->GetObjTypeSpecFldInfo(i);`
`263`	`263`	`if (info != nullptr)`
`264`	`264`	`{`
`265`		`- Assert(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());`
	`265`	`+ AssertOrFailFast(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());`
`266`	`266`	`GetTopFunc()->m_globalObjTypeSpecFldInfoArray[info->GetObjTypeSpecFldId()] = info;`
`267`	`267`	`}`
`268`	`268`	`}`