Skip to content

Commit 8bd6826

Browse files
sigatrevAtul Katti
sigatrev
authored and
Atul Katti
committed
[CVE-2018-8290] OOB profile read/write - Google, Inc
1 parent 7af07fd commit 8bd6826

File tree

3 files changed

+46
-32
lines changed

3 files changed

+46
-32
lines changed

‎lib/Runtime/Language/InterpreterHandler.inl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -375,8 +375,8 @@ EXDEF3_WMS(CUSTOM, LdLocalElemUndef, OP_LdLocalElemen
375375
DEF3 (CUSTOM_L_R0, NewScIntArray, OP_NewScIntArray, Auxiliary)
376376
DEF3 (CUSTOM_L_R0, NewScFltArray, OP_NewScFltArray, Auxiliary)
377377
DEF3_WMS(CUSTOM_L_R0, ProfiledNewScArray, PROFILEDOP(OP_ProfiledNewScArray, OP_ProfiledNewScArray_NoProfile), ProfiledReg1Unsigned1)
378-
DEF3 (CUSTOM_L_R0, ProfiledNewScIntArray, PROFILEDOP(OP_ProfiledNewScIntArray, OP_NewScIntArray), ProfiledAuxiliary)
379-
DEF3 (CUSTOM_L_R0, ProfiledNewScFltArray, PROFILEDOP(OP_ProfiledNewScFltArray, OP_NewScFltArray), ProfiledAuxiliary)
378+
DEF3 (CUSTOM_L_R0, ProfiledNewScIntArray, PROFILEDOP(ProfiledNewScIntArray<true>, ProfiledNewScIntArray<false>), ProfiledAuxiliary)
379+
DEF3 (CUSTOM_L_R0, ProfiledNewScFltArray, PROFILEDOP(ProfiledNewScFltArray<true>, ProfiledNewScFltArray<false>), ProfiledAuxiliary)
380380
DEF2_WMS(RegextoA1, NewRegEx, JavascriptRegExp::OP_NewRegEx)
381381
EXDEF3_WMS(CUSTOM, InitClass, OP_InitClass, Class)
382382
DEF2_WMS(BRBReturnP1toA1, BrOnEmpty, JavascriptOperators::OP_BrOnEmpty)

‎lib/Runtime/Language/InterpreterStackFrame.cpp

Lines changed: 30 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5144,14 +5144,6 @@ namespace Js
51445144

51455145
void InterpreterStackFrame::OP_NewScIntArray(const unaligned OpLayoutAuxiliary * playout)
51465146
{
5147-
#if ENABLE_PROFILE_INFO
5148-
if (isAutoProfiling)
5149-
{
5150-
OP_ProfiledNewScIntArray(static_cast<const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> *>(playout));
5151-
return;
5152-
}
5153-
#endif
5154-
51555147
const Js::AuxArray<int32> *ints = Js::ByteCodeReader::ReadAuxArray<int32>(playout->Offset, this->GetFunctionBody());
51565148

51575149
JavascriptNativeIntArray *arr = scriptContext->GetLibrary()->CreateNativeIntArrayLiteral(ints->count);
@@ -5168,8 +5160,15 @@ namespace Js
51685160
}
51695161

51705162
#if ENABLE_PROFILE_INFO
5171-
void InterpreterStackFrame::OP_ProfiledNewScIntArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout)
5163+
template <bool Profiled>
5164+
void InterpreterStackFrame::ProfiledNewScIntArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout)
51725165
{
5166+
if (!Profiled && !isAutoProfiling)
5167+
{
5168+
OP_NewScIntArray(playout);
5169+
return;
5170+
}
5171+
51735172
const Js::AuxArray<int32> *ints = Js::ByteCodeReader::ReadAuxArray<int32>(playout->Offset, this->GetFunctionBody());
51745173

51755174
Js::ProfileId profileId = playout->profileId;
@@ -5229,18 +5228,16 @@ namespace Js
52295228

52305229
SetReg(playout->R0, arr);
52315230
}
5231+
#else
5232+
template <bool Profiled>
5233+
void InterpreterStackFrame::ProfiledNewScIntArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout)
5234+
{
5235+
OP_NewScIntArray(playout);
5236+
}
52325237
#endif
52335238

52345239
void InterpreterStackFrame::OP_NewScFltArray(const unaligned OpLayoutAuxiliary * playout)
52355240
{
5236-
#if ENABLE_PROFILE_INFO
5237-
if (isAutoProfiling)
5238-
{
5239-
OP_ProfiledNewScFltArray(static_cast<const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> *>(playout));
5240-
return;
5241-
}
5242-
#endif
5243-
52445241
const Js::AuxArray<double> *doubles = Js::ByteCodeReader::ReadAuxArray<double>(playout->Offset, this->GetFunctionBody());
52455242

52465243
JavascriptNativeFloatArray *arr = scriptContext->GetLibrary()->CreateNativeFloatArrayLiteral(doubles->count);
@@ -5257,8 +5254,15 @@ namespace Js
52575254
}
52585255

52595256
#if ENABLE_PROFILE_INFO
5260-
void InterpreterStackFrame::OP_ProfiledNewScFltArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout)
5257+
template <bool Profiled>
5258+
void InterpreterStackFrame::ProfiledNewScFltArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout)
52615259
{
5260+
if (!Profiled && !isAutoProfiling)
5261+
{
5262+
OP_NewScFltArray(playout);
5263+
return;
5264+
}
5265+
52625266
const Js::AuxArray<double> *doubles = Js::ByteCodeReader::ReadAuxArray<double>(playout->Offset, this->GetFunctionBody());
52635267

52645268
Js::ProfileId profileId = playout->profileId;
@@ -5294,6 +5298,12 @@ namespace Js
52945298

52955299
SetReg(playout->R0, arr);
52965300
}
5301+
#else
5302+
template <bool Profiled>
5303+
void InterpreterStackFrame::ProfiledNewScFltArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout)
5304+
{
5305+
OP_NewScFltArray(playout);
5306+
}
52975307
#endif
52985308

52995309
void InterpreterStackFrame::OP_SetArraySegmentVars(const unaligned OpLayoutAuxiliary * playout)
@@ -6203,7 +6213,7 @@ namespace Js
62036213
}
62046214

62056215
template <class T, bool Profiled>
6206-
void InterpreterStackFrame::OP_NewScObjArray_Impl(const unaligned T* playout, const Js::AuxArray<uint32> *spreadIndices)
6216+
void InterpreterStackFrame::OP_ProfiledNewScObjArray_Impl(const unaligned T* playout, const Js::AuxArray<uint32> *spreadIndices)
62076217
{
62086218
// Always profile this operation when auto-profiling so that array type changes are tracked
62096219
#if ENABLE_PROFILE_INFO
@@ -6212,7 +6222,7 @@ namespace Js
62126222
Assert(!Profiled);
62136223
#endif
62146224
{
6215-
OP_NewScObject_Impl<T, Profiled, false>(playout, Js::Constants::NoInlineCacheIndex, spreadIndices);
6225+
OP_NewScObjArray_Impl<T, Profiled>(playout, spreadIndices);
62166226
return;
62176227
}
62186228

‎lib/Runtime/Language/InterpreterStackFrame.h

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -632,8 +632,10 @@ namespace Js
632632
template <class T> void OP_ProfiledNewScArray_NoProfile(const unaligned OpLayoutDynamicProfile<T> * playout) { ProfiledNewScArray<false, T>(playout); }
633633
void OP_NewScIntArray(const unaligned OpLayoutAuxiliary * playout);
634634
void OP_NewScFltArray(const unaligned OpLayoutAuxiliary * playout);
635-
void OP_ProfiledNewScIntArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout);
636-
void OP_ProfiledNewScFltArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout);
635+
template <bool Profiled> void ProfiledNewScIntArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout);
636+
template <bool Profiled> void ProfiledNewScFltArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout);
637+
void OP_ProfiledNewScIntArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout) { ProfiledNewScIntArray<true>(playout); }
638+
void OP_ProfiledNewScFltArray(const unaligned OpLayoutDynamicProfile<OpLayoutAuxiliary> * playout) { ProfiledNewScFltArray<true>(playout); }
637639

638640
template <class T> void OP_LdArrayHeadSegment(const unaligned T* playout);
639641

@@ -734,19 +736,21 @@ namespace Js
734736
template <bool Profile, bool JITLoopBody> void ProfiledLoopBodyStart(uint32 loopNumber, LayoutSize layoutSize, bool isFirstIteration);
735737
void OP_RecordImplicitCall(uint loopNumber);
736738
template <class T, bool Profiled, bool ICIndex> void OP_NewScObject_Impl(const unaligned T* playout, InlineCacheIndex inlineCacheIndex = Js::Constants::NoInlineCacheIndex, const Js::AuxArray<uint32> *spreadIndices = nullptr);
737-
template <class T, bool Profiled> void OP_NewScObjArray_Impl(const unaligned T* playout, const Js::AuxArray<uint32> *spreadIndices = nullptr);
739+
template <class T, bool Profiled, bool ICIndex> void OP_ProfiledNewScObject_Impl(const unaligned T* playout, InlineCacheIndex inlineCacheIndex = Js::Constants::NoInlineCacheIndex, const Js::AuxArray<uint32> *spreadIndices = nullptr) { OP_NewScObject_Impl<T, Profiled, ICIndex>(playout, inlineCacheIndex, spreadIndices); }
740+
template <class T, bool Profiled> void OP_NewScObjArray_Impl(const unaligned T* playout, const Js::AuxArray<uint32> *spreadIndices = nullptr) { OP_NewScObject_Impl<T, Profiled, false>(playout, Js::Constants::NoInlineCacheIndex, spreadIndices); }
741+
template <class T, bool Profiled> void OP_ProfiledNewScObjArray_Impl(const unaligned T* playout, const Js::AuxArray<uint32> *spreadIndices = nullptr);
738742
template <class T> void OP_NewScObject(const unaligned T* playout) { OP_NewScObject_Impl<T, false, false>(playout); }
739743
template <class T> void OP_NewScObjectNoCtorFull(const unaligned T* playout);
740744
template <class T> void OP_NewScObjectSpread(const unaligned T* playout) { OP_NewScObject_Impl<T, false, false>(playout, Js::Constants::NoInlineCacheIndex, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
741745
template <class T> void OP_NewScObjArray(const unaligned T* playout) { OP_NewScObjArray_Impl<T, false>(playout); }
742746
template <class T> void OP_NewScObjArraySpread(const unaligned T* playout) { OP_NewScObjArray_Impl<T, false>(playout, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
743-
template <class T> void OP_ProfiledNewScObject(const unaligned OpLayoutDynamicProfile<T>* playout) { OP_NewScObject_Impl<T, true, false>(playout); }
744-
template <class T> void OP_ProfiledNewScObjectSpread(const unaligned OpLayoutDynamicProfile<T>* playout) { OP_NewScObject_Impl<T, true, false>(playout, Js::Constants::NoInlineCacheIndex, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
745-
template <class T> void OP_ProfiledNewScObjectWithICIndex(const unaligned OpLayoutDynamicProfile<T>* playout) { OP_NewScObject_Impl<T, true, true>(playout, playout->inlineCacheIndex); }
746-
template <class T> void OP_ProfiledNewScObjArray(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_NewScObjArray_Impl<T, true>(playout); }
747-
template <class T> void OP_ProfiledNewScObjArray_NoProfile(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_NewScObjArray_Impl<T, false>(playout); }
748-
template <class T> void OP_ProfiledNewScObjArraySpread(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_NewScObjArray_Impl<T, true>(playout, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
749-
template <class T> void OP_ProfiledNewScObjArraySpread_NoProfile(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_NewScObjArray_Impl<T, true>(playout, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
747+
template <class T> void OP_ProfiledNewScObject(const unaligned OpLayoutDynamicProfile<T>* playout) { OP_ProfiledNewScObject_Impl<T, true, false>(playout); }
748+
template <class T> void OP_ProfiledNewScObjectSpread(const unaligned OpLayoutDynamicProfile<T>* playout) { OP_ProfiledNewScObject_Impl<T, true, false>(playout, Js::Constants::NoInlineCacheIndex, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
749+
template <class T> void OP_ProfiledNewScObjectWithICIndex(const unaligned OpLayoutDynamicProfile<T>* playout) { OP_ProfiledNewScObject_Impl<T, true, true>(playout, playout->inlineCacheIndex); }
750+
template <class T> void OP_ProfiledNewScObjArray(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_ProfiledNewScObjArray_Impl<T, true>(playout); }
751+
template <class T> void OP_ProfiledNewScObjArray_NoProfile(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_ProfiledNewScObjArray_Impl<T, false>(playout); }
752+
template <class T> void OP_ProfiledNewScObjArraySpread(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_ProfiledNewScObjArray_Impl<T, true>(playout, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
753+
template <class T> void OP_ProfiledNewScObjArraySpread_NoProfile(const unaligned OpLayoutDynamicProfile2<T>* playout) { OP_ProfiledNewScObjArray_Impl<T, false>(playout, m_reader.ReadAuxArray<uint32>(playout->SpreadAuxOffset, this->GetFunctionBody())); }
750754
Var NewScObject_Helper(Var target, ArgSlot ArgCount, const Js::AuxArray<uint32> *spreadIndices = nullptr);
751755
Var ProfiledNewScObject_Helper(Var target, ArgSlot ArgCount, ProfileId profileId, InlineCacheIndex inlineCacheIndex, const Js::AuxArray<uint32> *spreadIndices = nullptr);
752756
template <class T, bool Profiled, bool ICIndex> Var OP_NewScObjectNoArg_Impl(const unaligned T *playout, InlineCacheIndex inlineCacheIndex = Js::Constants::NoInlineCacheIndex);

0 commit comments

Comments
 (0)