Microsoft Edge Chakra JavascriptFunction::ReparseAsmJsModule Parsing Issue

Microsoft Edge Chakra JavascriptFunction::ReparseAsmJsModule suffers from a parsing issue.


MD5 | e42ea1ce1dac6aa761323bae506ada67

Microsoft Edge: Chakra: JavascriptFunction::ReparseAsmJsModule incorrectly re-parses 

CVE-2017-8755


This is similar to the <a href="/p/project-zero/issues/detail?id=1271" title="Microsoft Edge: Chakra: InterpreterStackFrame::ProcessLinkFailedAsmJsModule incorrectly re-parses" class="closed_ref" rel="nofollow"> issue 1271 </a>.

Here's the method used to re-parse asmjs modules.
void JavascriptFunction::ReparseAsmJsModule(ScriptFunction** functionRef)
{
ParseableFunctionInfo* functionInfo = (*functionRef)->GetParseableFunctionInfo();
Assert(functionInfo);
functionInfo->GetFunctionBody()->AddDeferParseAttribute();
functionInfo->GetFunctionBody()->ResetEntryPoint();
functionInfo->GetFunctionBody()->ResetInParams();

FunctionBody * funcBody = functionInfo->Parse(functionRef);

#if ENABLE_PROFILE_INFO
// This is the first call to the function, ensure dynamic profile info
funcBody->EnsureDynamicProfileInfo();
Related Posts

Comments