Skip to content

Commit ffe5939

Browse files
agarwal-sandeepagarwal-sandeep
committed
[MERGE #3917 @agarwal-sandeep] 17-10 Security Update that addresses the following issues in ChakraCore
Merge pull request #3917 from agarwal-sandeep:1710Fixes CVE-2017-11792, CVE-2017-11796, CVE-2017-11797, CVE-2017-11799, CVE-2017-11801, CVE-2017-11802, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11811, CVE-2017-11812, CVE-2017-11821
2 parents d234b08 + a2e1959 commit ffe5939

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+505
-131
lines changed

‎Build/NuGet/.pack-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.7.2
1+
1.7.3

‎lib/Backend/GlobOpt.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17122,7 +17122,7 @@ GlobOpt::IsSwitchOptEnabled(Func const * func)
1712217122
{
1712317123
Assert(func->IsTopFunc());
1712417124
return !PHASE_OFF(Js::SwitchOptPhase, func) && !func->IsSwitchOptDisabled() && !IsTypeSpecPhaseOff(func)
17125-
&& func->DoGlobOpt() && !func->HasTry();
17125+
&& DoAggressiveIntTypeSpec(func) && func->DoGlobOpt() && !func->HasTry();
1712617126
}
1712717127

1712817128
bool

‎lib/Backend/IRBuilderAsmJs.cpp

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1027,6 +1027,11 @@ IRBuilderAsmJs::BuildEmpty(Js::OpCodeAsmJs newOpcode, uint32 offset)
10271027
Js::RegSlot retSlot;
10281028
switch (newOpcode)
10291029
{
1030+
case Js::OpCodeAsmJs::CheckHeap:
1031+
instr = IR::Instr::New(Js::OpCode::ArrayDetachedCheck, m_func);
1032+
instr->SetSrc1(IR::IndirOpnd::New(BuildSrcOpnd(AsmJsRegSlots::ArrayReg, TyVar), Js::ArrayBuffer::GetIsDetachedOffset(), TyInt8, m_func));
1033+
AddInstr(instr, offset);
1034+
break;
10301035
case Js::OpCodeAsmJs::Unreachable_Void:
10311036
instr = IR::Instr::New(Js::OpCode::ThrowRuntimeError, m_func);
10321037
instr->SetSrc1(IR::IntConstOpnd::New(SCODE_CODE(WASMERR_Unreachable), TyInt32, instr->m_func));
@@ -1775,23 +1780,13 @@ IRBuilderAsmJs::BuildAsmCall(Js::OpCodeAsmJs newOpcode, uint32 offset, Js::ArgSl
17751780
{
17761781
m_func->m_argSlotsForFunctionsCalled = argCount;
17771782
}
1778-
if (m_asmFuncInfo->UsesHeapBuffer())
1779-
{
1780-
// heap buffer can change for wasm
17811783
#ifdef ENABLE_WASM
1782-
if (m_func->GetJITFunctionBody()->IsWasmFunction())
1783-
{
1784-
BuildHeapBufferReload(offset);
1785-
}
1786-
#endif
1787-
// after foreign function call, we need to make sure that the heap hasn't been detached
1788-
if (newOpcode == Js::OpCodeAsmJs::Call)
1789-
{
1790-
IR::Instr * instrArrayDetachedCheck = IR::Instr::New(Js::OpCode::ArrayDetachedCheck, m_func);
1791-
instrArrayDetachedCheck->SetSrc1(IR::IndirOpnd::New(BuildSrcOpnd(AsmJsRegSlots::ArrayReg, TyVar), Js::ArrayBuffer::GetIsDetachedOffset(), TyInt8, m_func));
1792-
AddInstr(instrArrayDetachedCheck, offset);
1793-
}
1784+
// heap buffer can change for wasm
1785+
if (m_asmFuncInfo->UsesHeapBuffer() && m_func->GetJITFunctionBody()->IsWasmFunction())
1786+
{
1787+
BuildHeapBufferReload(offset);
17941788
}
1789+
#endif
17951790
}
17961791

17971792
void

‎lib/Backend/Lower.cpp

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13373,6 +13373,14 @@ Lowerer::GenerateBailOut(IR::Instr * instr, IR::BranchInstr * branchInstr, IR::L
1337313373
// src1 on BailOnNotStackArgs is helping CSE
1337413374
instr->FreeSrc1();
1337513375
}
13376+
13377+
if (instr->GetSrc2() != nullptr)
13378+
{
13379+
// Ideally we should never be in this situation but incase we reached a
13380+
// condition where we didn't freed src2. Free it here.
13381+
instr->FreeSrc2();
13382+
}
13383+
1337613384
// Call the bail out wrapper
1337713385
instr->m_opcode = Js::OpCode::Call;
1337813386
if(instr->GetDst())
@@ -23366,7 +23374,7 @@ Lowerer::GenerateRecyclerAlloc(IR::JnHelperMethod allocHelper, size_t allocSize,
2336623374
}
2336723375

2336823376
void
23369-
Lowerer::GenerateMemInit(IR::RegOpnd * opnd, int32 offset, int value, IR::Instr * insertBeforeInstr, bool isZeroed)
23377+
Lowerer::GenerateMemInit(IR::RegOpnd * opnd, int32 offset, int32 value, IR::Instr * insertBeforeInstr, bool isZeroed)
2337023378
{
2337123379
IRType type = TyInt32;
2337223380
if (isZeroed)
@@ -24191,7 +24199,7 @@ Lowerer::LowerNewScopeSlots(IR::Instr * instr, bool doStackSlots)
2419124199
IR::RegOpnd * dst = instr->UnlinkDst()->AsRegOpnd();
2419224200

2419324201
// dst = RecyclerAlloc(allocSize)
24194-
// dst[EncodedSlotCountSlotIndex = EncodedSlotCountSlotIOndex];
24202+
// dst[EncodedSlotCountSlotIndex] = min(actualSlotCount, MaxEncodedSlotCount);
2419524203
// dst[ScopeMetadataSlotIndex] = FunctionBody;
2419624204
// mov undefinedOpnd, undefined
2419724205
// dst[FirstSlotIndex..count] = undefinedOpnd;
@@ -24202,8 +24210,10 @@ Lowerer::LowerNewScopeSlots(IR::Instr * instr, bool doStackSlots)
2420224210
{
2420324211
GenerateRecyclerAlloc(IR::HelperAllocMemForVarArray, allocSize, dst, instr);
2420424212
}
24205-
GenerateMemInit(dst, Js::ScopeSlots::EncodedSlotCountSlotIndex * sizeof(Js::Var),
24206-
min<uint>(actualSlotCount, Js::ScopeSlots::MaxEncodedSlotCount), instr, !doStackSlots);
24213+
24214+
m_lowererMD.GenerateMemInit(dst, Js::ScopeSlots::EncodedSlotCountSlotIndex * sizeof(Js::Var),
24215+
(size_t)min<uint>(actualSlotCount, Js::ScopeSlots::MaxEncodedSlotCount), instr, !doStackSlots);
24216+
2420724217
IR::Opnd * functionInfoOpnd = this->LoadFunctionInfoOpnd(instr);
2420824218
GenerateMemInit(dst, Js::ScopeSlots::ScopeMetadataSlotIndex * sizeof(Js::Var),
2420924219
functionInfoOpnd, instr, !doStackSlots);
@@ -25143,7 +25153,7 @@ Lowerer::LowerFrameDisplayCheck(IR::Instr * instr)
2514325153

2514425154
indirOpnd = IR::IndirOpnd::New(slotArrayOpnd,
2514525155
Js::ScopeSlots::EncodedSlotCountSlotIndex * sizeof(Js::Var),
25146-
TyUint32, m_func, true);
25156+
TyVar, m_func, true);
2514725157
IR::IntConstOpnd * slotIdOpnd = IR::IntConstOpnd::New(slotId - Js::ScopeSlots::FirstSlotIndex,
2514825158
TyUint32, m_func);
2514925159
InsertCompareBranch(indirOpnd, slotIdOpnd, Js::OpCode::BrLe_A, true, errorLabel, insertInstr);
@@ -25198,7 +25208,7 @@ Lowerer::LowerSlotArrayCheck(IR::Instr * instr)
2519825208

2519925209
IR::IndirOpnd * indirOpnd = IR::IndirOpnd::New(IR::RegOpnd::New(stackSym, TyVar, m_func),
2520025210
Js::ScopeSlots::EncodedSlotCountSlotIndex * sizeof(Js::Var),
25201-
TyUint32, m_func, true);
25211+
TyVar, m_func, true);
2520225212

2520325213
slotIdOpnd->SetValue(slotId - Js::ScopeSlots::FirstSlotIndex);
2520425214
InsertCompareBranch(indirOpnd, slotIdOpnd, Js::OpCode::BrGt_A, true, continueLabel, insertInstr);

‎lib/Backend/LowerMDShared.cpp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,16 @@ LowererMD::GenerateMemRef(intptr_t addr, IRType type, IR::Instr *instr, bool don
6262
return IR::MemRefOpnd::New(addr, type, this->m_func);
6363
}
6464

65+
void
66+
LowererMD::GenerateMemInit(IR::RegOpnd * opnd, int32 offset, size_t value, IR::Instr * insertBeforeInstr, bool isZeroed)
67+
{
68+
#if _M_X64
69+
lowererMDArch.GenerateMemInit(opnd, offset, value, insertBeforeInstr, isZeroed);
70+
#else
71+
m_lowerer->GenerateMemInit(opnd, offset, (uint32)value, insertBeforeInstr, isZeroed);
72+
#endif
73+
}
74+
6575
///----------------------------------------------------------------------------
6676
///
6777
/// LowererMD::InvertBranch

‎lib/Backend/LowerMDShared.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ class LowererMD
7272
public:
7373
void Init(Lowerer *lowerer);
7474
IR::Opnd * GenerateMemRef(intptr_t addr, IRType type, IR::Instr *instr, bool dontEncode = false);
75+
void GenerateMemInit(IR::RegOpnd * opnd, int32 offset, size_t value, IR::Instr * insertBeforeInstr, bool isZeroed = false);
7576
IR::Instr * ChangeToHelperCall(IR::Instr * instr, IR::JnHelperMethod helperMethod, IR::LabelInstr *labelBailOut = nullptr,
7677
IR::Opnd *opndInstance = nullptr, IR::PropertySymOpnd * propSymOpnd = nullptr, bool isHelperContinuation = false);
7778
void FinalLower();

‎lib/Backend/amd64/LowererMDArch.cpp

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -577,6 +577,28 @@ LowererMDArch::SetMaxArgSlots(Js::ArgSlot actualCount /*including this*/)
577577
return;
578578
}
579579

580+
void
581+
LowererMDArch::GenerateMemInit(IR::RegOpnd * opnd, int32 offset, size_t value, IR::Instr * insertBeforeInstr, bool isZeroed)
582+
{
583+
IRType type = TyVar;
584+
if (isZeroed)
585+
{
586+
if (value == 0)
587+
{
588+
// Recycler memory are zero initialized
589+
return;
590+
}
591+
592+
type = value <= UINT_MAX ?
593+
(value <= USHORT_MAX ?
594+
(value <= UCHAR_MAX ? TyUint8 : TyUint16) :
595+
TyUint32) :
596+
type;
597+
}
598+
Func * func = this->m_func;
599+
lowererMD->GetLowerer()->InsertMove(IR::IndirOpnd::New(opnd, offset, type, func), IR::IntConstOpnd::New(value, type, func), insertBeforeInstr);
600+
}
601+
580602
IR::Instr *
581603
LowererMDArch::LowerCallIDynamic(IR::Instr *callInstr, IR::Instr*saveThisArgOutInstr, IR::Opnd *argsLength, ushort callFlags, IR::Instr * insertBeforeInstrForCFG)
582604
{

‎lib/Backend/amd64/LowererMDArch.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@ class LowererMDArch
158158
IR::LabelInstr * GetBailOutStackRestoreLabel(BailOutInfo * bailOutInfo, IR::LabelInstr * exitTargetInstr);
159159
void GeneratePreCall(IR::Instr * callInstr, IR::Opnd *functionObjOpnd, IR::Instr* insertBeforeInstrForCFGCheck = nullptr);
160160
void SetMaxArgSlots(Js::ArgSlot actualCount /*including this*/);
161+
void GenerateMemInit(IR::RegOpnd * opnd, int32 offset, size_t value, IR::Instr * insertBeforeInstr, bool isZeroed = false);
161162
};
162163

163164
#define REG_EH_TARGET RegArg0

‎lib/Backend/arm/LowerMD.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -378,6 +378,12 @@ LowererMD::SetMaxArgSlots(Js::ArgSlot actualCount /*including this*/)
378378
return;
379379
}
380380

381+
void
382+
LowererMD::GenerateMemInit(IR::RegOpnd * opnd, int32 offset, size_t value, IR::Instr * insertBeforeInstr, bool isZeroed)
383+
{
384+
m_lowerer->GenerateMemInit(opnd, offset, (uint32)value, insertBeforeInstr, isZeroed);
385+
}
386+
381387
IR::Instr *
382388
LowererMD::LowerCallIDynamic(IR::Instr *callInstr, IR::Instr*saveThisArgOutInstr, IR::Opnd *argsLength, ushort callFlags, IR::Instr * insertBeforeInstrForCFG)
383389
{

‎lib/Backend/arm/LowerMD.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,7 @@ class LowererMD
275275

276276
void LowerInlineSpreadArgOutLoop(IR::Instr *callInstr, IR::RegOpnd *indexOpnd, IR::RegOpnd *arrayElementsStartOpnd);
277277
void LowerTypeof(IR::Instr * typeOfInstr);
278+
void GenerateMemInit(IR::RegOpnd * opnd, int32 offset, size_t value, IR::Instr * insertBeforeInstr, bool isZeroed = false);
278279

279280
public:
280281
static IR::Instr * InsertCmovCC(const Js::OpCode opCode, IR::Opnd * dst, IR::Opnd* src1, IR::Instr* insertBeforeInstr, bool postRegAlloc);

0 commit comments

Comments
 (0)