[CVE-2019-0658] Microsoft Chakra JIT server array out-of-bounds access

MikeHolman · MikeHolman · commit b778ca81c7d0 · 2019-02-07T11:33:14.000-08:00
diff --git a/lib/Backend/FunctionJITTimeInfo.cpp b/lib/Backend/FunctionJITTimeInfo.cpp
@@ -302,11 +302,11 @@ FunctionJITTimeInfo::GetRuntimeInfo() const
 ObjTypeSpecFldInfo *
 FunctionJITTimeInfo::GetObjTypeSpecFldInfo(uint index) const
 {
-    AssertOrFailFast(index < GetBody()->GetInlineCacheCount());
     if (m_data.objTypeSpecFldInfoArray == nullptr)
     {
         return nullptr;
     }
+    AssertOrFailFast(index < m_data.objTypeSpecFldInfoCount);
 
     return reinterpret_cast<ObjTypeSpecFldInfo *>(m_data.objTypeSpecFldInfoArray[index]);
 }

Original file line number	Diff line number	Diff line change
`@@ -302,11 +302,11 @@ FunctionJITTimeInfo::GetRuntimeInfo() const`
`302`	`302`	`ObjTypeSpecFldInfo *`
`303`	`303`	`FunctionJITTimeInfo::GetObjTypeSpecFldInfo(uint index) const`
`304`	`304`	`{`
`305`		`- AssertOrFailFast(index < GetBody()->GetInlineCacheCount());`
`306`	`305`	`if (m_data.objTypeSpecFldInfoArray == nullptr)`
`307`	`306`	`{`
`308`	`307`	`return nullptr;`
`309`	`308`	`}`
	`309`	`+ AssertOrFailFast(index < m_data.objTypeSpecFldInfoCount);`
`310`	`310`
`311`	`311`	`return reinterpret_cast<ObjTypeSpecFldInfo *>(m_data.objTypeSpecFldInfoArray[index]);`
`312`	`312`	`}`