EDB-ID: 42465 | Author: Huang Anwen | Published: 2017-08-17 | CVE: CVE-2017-8641 | Type: Dos | Platform: Windows | Vulnerable App: N/A | Report by Huang Anwen, He Xiaoxiao of ichunqiu Ker Team
There is a classic heap overflow when eval a string which large enough in Chakra!
This issue can be reproduced steadly in uptodate Edge in Win10 WIP.
An exception will occur immediatly when opening POC.html in Edge.
//ChakraCore-master\lib\Runtime\Library\GlobalObject.cpp
ScriptFunction* GlobalObject::DefaultEvalHelper(ScriptContext* scriptContext, const char16 *source, int sourceLength, ModuleID moduleID, uint32 grfscr, LPCOLESTR pszTitle, BOOL registerDocument, BOOL isIndirect, BOOL strictMode)
{
Assert(sourceLength >= 0);
AnalysisAssert(scriptContext);
if (scriptContext->GetThreadContext()->EvalDisabled())
{
throw Js::EvalDisabledException();
}
#ifdef PROFILE_EXEC
scriptContext->ProfileBegin(Js::EvalCompilePhase);