[CVE-2017-0150] DeferDeserialize is not working properly with asm.js ChangeHeap

MikeHolman · MikeHolman · commit dd61e049dee4 · 2017-03-16T15:36:35.000-07:00
diff --git a/lib/Runtime/ByteCode/FuncInfo.cpp b/lib/Runtime/ByteCode/FuncInfo.cpp
@@ -13,7 +13,7 @@ FuncInfo::FuncInfo(
     Js::ParseableFunctionInfo* byteCodeFunction)
     : alloc(alloc),
     varRegsCount(0),
-    constRegsCount(2),
+    constRegsCount(InitialConstRegsCount),
     inArgsCount(0),
     innerScopeCount(0),
     currentInnerScopeIndex((uint)-1),
diff --git a/lib/Runtime/ByteCode/FuncInfo.h b/lib/Runtime/ByteCode/FuncInfo.h
@@ -83,6 +83,8 @@ class FuncInfo
     uint        nextForInLoopLevel;
     uint        maxForInLoopLevel;
 public:
+    static const Js::RegSlot InitialConstRegsCount = 2; // constRegsCount is set to 2 because R0 is the return register, and R1 is the root object
+
     ArenaAllocator *alloc;
     // set in Bind/Assign pass
     Js::RegSlot varRegsCount; // number of registers used for non-constants
@@ -192,7 +194,6 @@ class FuncInfo
     Symbol *innerArgumentsSymbol;
     JsUtil::List<Js::RegSlot, ArenaAllocator> nonUserNonTempRegistersToInitialize;
 
-    // constRegsCount is set to 2 because R0 is the return register, and R1 is the root object.
     FuncInfo(
         const char16 *name,
         ArenaAllocator *alloc,
diff --git a/lib/Runtime/Language/AsmJsByteCodeGenerator.cpp b/lib/Runtime/Language/AsmJsByteCodeGenerator.cpp
@@ -3324,6 +3324,8 @@ namespace Js
         byteCodeGen->Writer()->EndStatement(functionNode);
         byteCodeGen->Writer()->End();
 
+        functionBody->CheckAndSetConstantCount(FuncInfo::InitialConstRegsCount);
+
         autoCleanup.Done();
     }
 
diff --git a/lib/Runtime/Language/InterpreterStackFrame.cpp b/lib/Runtime/Language/InterpreterStackFrame.cpp
@@ -2772,16 +2772,18 @@ namespace Js
 
                 AsmJsScriptFunction* scriptFuncObj = (AsmJsScriptFunction*)ScriptFunction::OP_NewScFunc(pDisplay, functionInfo);
                 localModuleFunctions[modFunc.location] = scriptFuncObj;
+
+                if (scriptFuncObj->GetDynamicType()->GetEntryPoint() == DefaultDeferredDeserializeThunk)
+                {
+                    JavascriptFunction::DeferredDeserialize(scriptFuncObj);
+                }
+
                 if (i == 0 && info->GetUsesChangeHeap())
                 {
                     scriptFuncObj->GetDynamicType()->SetEntryPoint(AsmJsChangeHeapBuffer);
                 }
                 else
                 {
-                    if (scriptFuncObj->GetDynamicType()->GetEntryPoint() == DefaultDeferredDeserializeThunk)
-                    {
-                        JavascriptFunction::DeferredDeserialize(scriptFuncObj);
-                    }
                     scriptFuncObj->GetDynamicType()->SetEntryPoint(AsmJsExternalEntryPoint);
                     scriptFuncObj->GetFunctionBody()->GetAsmJsFunctionInfo()->SetModuleFunctionBody(asmJsModuleFunctionBody);
                 }

Original file line number	Diff line number	Diff line change
`@@ -3324,6 +3324,8 @@ namespace Js`
`3324`	`3324`	`byteCodeGen->Writer()->EndStatement(functionNode);`
`3325`	`3325`	`byteCodeGen->Writer()->End();`
`3326`	`3326`
	`3327`	`+ functionBody->CheckAndSetConstantCount(FuncInfo::InitialConstRegsCount);`
	`3328`	`+`
`3327`	`3329`	`autoCleanup.Done();`
`3328`	`3330`	`}`
`3329`	`3331`
Original file line number	Diff line number	Diff line change
`@@ -2772,16 +2772,18 @@ namespace Js`
`2772`	`2772`
`2773`	`2773`	`AsmJsScriptFunction* scriptFuncObj = (AsmJsScriptFunction*)ScriptFunction::OP_NewScFunc(pDisplay, functionInfo);`
`2774`	`2774`	`localModuleFunctions[modFunc.location] = scriptFuncObj;`
	`2775`	`+`
	`2776`	`+ if (scriptFuncObj->GetDynamicType()->GetEntryPoint() == DefaultDeferredDeserializeThunk)`
	`2777`	`+ {`
	`2778`	`+ JavascriptFunction::DeferredDeserialize(scriptFuncObj);`
	`2779`	`+ }`
	`2780`	`+`
`2775`	`2781`	`if (i == 0 && info->GetUsesChangeHeap())`
`2776`	`2782`	`{`
`2777`	`2783`	`scriptFuncObj->GetDynamicType()->SetEntryPoint(AsmJsChangeHeapBuffer);`
`2778`	`2784`	`}`
`2779`	`2785`	`else`
`2780`	`2786`	`{`
`2781`		`- if (scriptFuncObj->GetDynamicType()->GetEntryPoint() == DefaultDeferredDeserializeThunk)`
`2782`		`- {`
`2783`		`- JavascriptFunction::DeferredDeserialize(scriptFuncObj);`
`2784`		`- }`
`2785`	`2787`	`scriptFuncObj->GetDynamicType()->SetEntryPoint(AsmJsExternalEntryPoint);`
`2786`	`2788`	`scriptFuncObj->GetFunctionBody()->GetAsmJsFunctionInfo()->SetModuleFunctionBody(asmJsModuleFunctionBody);`
`2787`	`2789`	`}`