[CVE-2019-0649] Microsoft Chakra JIT server construct Caches array out-of-bounds

MikeHolman · MikeHolman · commit beba75a1aed0 · 2019-02-07T11:31:55.000-08:00
diff --git a/lib/Backend/Func.cpp b/lib/Backend/Func.cpp
@@ -1673,14 +1673,14 @@ Func::LinkCtorCacheToPropertyId(Js::PropertyId propertyId, JITTimeConstructorCac
 
 JITTimeConstructorCache* Func::GetConstructorCache(const Js::ProfileId profiledCallSiteId)
 {
-    Assert(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());
+    AssertOrFailFast(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());
     Assert(this->constructorCaches != nullptr);
     return this->constructorCaches[profiledCallSiteId];
 }
 
 void Func::SetConstructorCache(const Js::ProfileId profiledCallSiteId, JITTimeConstructorCache* constructorCache)
 {
-    Assert(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());
+    AssertOrFailFast(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());
     Assert(constructorCache != nullptr);
     Assert(this->constructorCaches != nullptr);
     Assert(this->constructorCaches[profiledCallSiteId] == nullptr);

Original file line number	Diff line number	Diff line change
`@@ -1673,14 +1673,14 @@ Func::LinkCtorCacheToPropertyId(Js::PropertyId propertyId, JITTimeConstructorCac`
`1673`	`1673`
`1674`	`1674`	`JITTimeConstructorCache* Func::GetConstructorCache(const Js::ProfileId profiledCallSiteId)`
`1675`	`1675`	`{`
`1676`		`- Assert(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());`
	`1676`	`+ AssertOrFailFast(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());`
`1677`	`1677`	`Assert(this->constructorCaches != nullptr);`
`1678`	`1678`	`return this->constructorCaches[profiledCallSiteId];`
`1679`	`1679`	`}`
`1680`	`1680`
`1681`	`1681`	`void Func::SetConstructorCache(const Js::ProfileId profiledCallSiteId, JITTimeConstructorCache* constructorCache)`
`1682`	`1682`	`{`
`1683`		`- Assert(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());`
	`1683`	`+ AssertOrFailFast(profiledCallSiteId < GetJITFunctionBody()->GetProfiledCallSiteCount());`
`1684`	`1684`	`Assert(constructorCache != nullptr);`
`1685`	`1685`	`Assert(this->constructorCaches != nullptr);`
`1686`	`1686`	`Assert(this->constructorCaches[profiledCallSiteId] == nullptr);`