Skip to content

Commit 80cfdbb

Browse files
MikeHolmanMikeHolman
committed
[CVE-2017-0067] prevent parser from getting into inconsistent state when asm.js parse fails
1 parent bf4ef6c commit 80cfdbb

10 files changed

Lines changed: 248 additions & 213 deletions

File tree

‎lib/Runtime/Base/FunctionBody.cpp‎

Lines changed: 179 additions & 166 deletions
Large diffs are not rendered by default.

‎lib/Runtime/ByteCode/ByteCodeEmitter.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3633,9 +3633,9 @@ void ByteCodeGenerator::EmitScopeList(ParseNode *pnode, ParseNode *breakOnBodySc
36333633
{
36343634
exit(JSERR_AsmJsCompileError);
36353635
}
3636-
else if (!(flags & fscrDeferFncParse))
3636+
else
36373637
{
3638-
// If deferral is not allowed, throw and reparse everything with asm.js disabled.
3638+
// if asm.js parse error happened, reparse with asm.js disabled.
36393639
throw Js::AsmJsParseException();
36403640
}
36413641
}

‎lib/Runtime/Library/GlobalObject.cpp‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -944,17 +944,16 @@ namespace Js
944944
{
945945
JavascriptError::ThrowStackOverflowError(scriptContext);
946946
}
947-
JavascriptError::MapAndThrowError(scriptContext, hrCodeGen);
948-
}
949-
else
950-
{
951-
if (se.ei.scode == JSERR_AsmJsCompileError)
947+
else if (hrCodeGen == JSERR_AsmJsCompileError)
952948
{
953949
// if asm.js compilation succeeded, retry with asm.js disabled
954950
grfscr |= fscrNoAsmJs;
955-
se.Clear();
956951
return DefaultEvalHelper(scriptContext, source, sourceLength, moduleID, grfscr, pszTitle, registerDocument, isIndirect, strictMode);
957952
}
953+
JavascriptError::MapAndThrowError(scriptContext, hrCodeGen);
954+
}
955+
else
956+
{
958957

959958
Assert(funcBody != nullptr);
960959
funcBody->SetDisplayName(pszTitle);

‎test/AsmJs/nested.baseline‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
closure functions are not allowed
2+
Asm.js compilation failed.

‎test/AsmJs/nested.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
//-------------------------------------------------------------------------------------------------------
2+
// Copyright (C) Microsoft. All rights reserved.
3+
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
4+
//-------------------------------------------------------------------------------------------------------
5+
6+
function AsmModule() {
7+
"use asm";
8+
function f() {
9+
function g() { }
10+
}
11+
}
12+
AsmModule();

‎test/AsmJs/qmarkbug.baseline‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11

2-
qmarkbug.js(9, 3)
2+
qmarkbug.js(6, 5)
33
Asm.js Compilation Error function : None::f
44
Conditional expressions must be of type int, double, or float
55

66
Asm.js compilation failed.
77

8-
qmarkbug.js(25, 3)
8+
qmarkbug.js(6, 5)
99
Asm.js Compilation Error function : None::f
1010
Conditional expressions must be of type int, double, or float
1111

‎test/AsmJs/qmarkbug.js‎

Lines changed: 32 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3,34 +3,36 @@
33
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
44
//-------------------------------------------------------------------------------------------------------
55

6-
var asmModule =
7-
(function(stdlib, foreign, heap) { 'use asm'; var Uint8ArrayView = new stdlib.Uint8Array(heap);
8-
var Int16ArrayView = new stdlib.Int16Array(heap);
9-
function f(d0, i1)
10-
{
11-
d0 = +d0;
12-
i1 = i1|0;
13-
var i4 = 0;
14-
i4 = ((0) ? 0 : ((Uint8ArrayView[0])));
15-
return +((-7.555786372591432e+22));
16-
}
17-
return f; })
6+
eval(`
7+
(function(stdlib, foreign, heap) {
8+
'use asm';
9+
var Uint8ArrayView = new stdlib.Uint8Array(heap);
10+
var Int16ArrayView = new stdlib.Int16Array(heap);
11+
function f(d0, i1)
12+
{
13+
d0 = +d0;
14+
i1 = i1|0;
15+
var i4 = 0;
16+
i4 = ((0) ? 0 : ((Uint8ArrayView[0])));
17+
return +((-7.555786372591432e+22));
18+
}
19+
return f;
20+
})(this, {}, new ArrayBuffer(1<<24));
21+
`);
1822

19-
var asmHeap = new ArrayBuffer(1<<24);
20-
var asmFun = asmModule(this, {}, asmHeap);
21-
asmFun();
22-
var asmModule =
23-
(function(stdlib, foreign, heap) { 'use asm'; var Uint8ArrayView = new stdlib.Uint8Array(heap);
24-
var Int16ArrayView = new stdlib.Int16Array(heap);
25-
function f(d0, i1)
26-
{
27-
d0 = +d0;
28-
i1 = i1|0;
29-
var i4 = 0;
30-
i4 = ((0) ? ((Uint8ArrayView[0])): 0 );
31-
return +((-7.555786372591432e+22));
32-
}
33-
return f; })
34-
35-
var asmFun = asmModule(this, {}, asmHeap);
36-
asmFun();
23+
eval(`
24+
(function(stdlib, foreign, heap) {
25+
'use asm';
26+
var Uint8ArrayView = new stdlib.Uint8Array(heap);
27+
var Int16ArrayView = new stdlib.Int16Array(heap);
28+
function f(d0, i1)
29+
{
30+
d0 = +d0;
31+
i1 = i1|0;
32+
var i4 = 0;
33+
i4 = ((0) ? ((Uint8ArrayView[0])): 0 );
34+
return +((-7.555786372591432e+22));
35+
}
36+
return f;
37+
})(this, {}, new ArrayBuffer(1<<24));
38+
`);

‎test/AsmJs/rlexe.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -814,4 +814,11 @@
814814
<compile-flags>-testtrace:asmjs -maic:1</compile-flags>
815815
</default>
816816
</test>
817+
<test>
818+
<default>
819+
<files>nested.js</files>
820+
<baseline>nested.baseline</baseline>
821+
<compile-flags>-forcedeferparse -testtrace:asmjs -simdjs</compile-flags>
822+
</default>
823+
</test>
817824
</regress-exe>

‎test/AsmJs/shadowingBug.baseline‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11

2-
shadowingBug.js(7, 97)
2+
shadowingBug.js(1, 97)
33
Asm.js Compilation Error function : None::f1
44
Invalid identifier f64
55

66
Asm.js compilation failed.
7+
0
78

8-
shadowingBug.js(8, 97)
9+
shadowingBug.js(1, 97)
910
Asm.js Compilation Error function : None::f1
1011
Invalid identifier f64
1112

1213
Asm.js compilation failed.
14+
NaN
1315
Var declaration with non-constant
1416
Asm.js compilation failed.
1517
0
16-
NaN
17-
0
1818
0

‎test/AsmJs/shadowingBug.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
//-------------------------------------------------------------------------------------------------------
55

66
var buffer = new ArrayBuffer(1<<20);
7-
print((function (stdlib,foreign,buffer) { "use asm"; var f64 = new stdlib.Float64Array(buffer); function f1(){ var f64 = 1.; f64[0] = 0.0;return +0.0;} return f1;})(this,{},buffer)());
8-
print((function (stdlib,foreign,buffer) { "use asm"; var f64 = new stdlib.Float64Array(buffer); function f1(){ var f64 = 1.; return +f64[0];} return f1;})(this,{},buffer)());
9-
print((function (stdlib,foreign,buffer) { "use asm"; const a = 10; function f1(){ var a =0; var b = a; return b|0;} return f1;})(this,{},buffer)());
7+
eval('print((function (stdlib,foreign,buffer) { "use asm"; var f64 = new stdlib.Float64Array(buffer); function f1(){ var f64 = 1.; f64[0] = 0.0;return +0.0;} return f1;})(this,{},buffer)())');
8+
eval('print((function (stdlib,foreign,buffer) { "use asm"; var f64 = new stdlib.Float64Array(buffer); function f1(){ var f64 = 1.; return +f64[0];} return f1;})(this,{},buffer)())');
9+
eval('print((function (stdlib,foreign,buffer) { "use asm"; const a = 10; function f1(){ var a =0; var b = a; return b|0;} return f1;})(this,{},buffer)())');
1010

1111
var f64Arr = new Float64Array(buffer);
1212
print(f64Arr[0]);

0 commit comments

Comments
 (0)