ChakraCore 2018-03 Security updates #4812
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… call param under Eval - Individual We missed handing call node destructuring pattern for the call node generated using tagged string template. Fixed that.
While updating the lastInput, we have caused the .match function to be called which made the regexp data to be invalid. Fixed that by Ensuring again in-case the reset flag is set or not.
…osure - Individual We should be updating the fullname length once we have concatenated strings.
…dividual Callbacks while sorting causes the head of an array to not have any missing value, although later we cause an exception in the sorting. Which left the array in the inconsistent state. Later in the HeadSegmentIndexOfHelper we exploit that situation. Fixed that by reseting the no-missing value state in the no-exception case. And also put fail-fast where we don't expect it happen.
…InstrMap - Google, Inc Run TryReplaceLdLen only when not in loop prepass Found by OSSFuzz
…name may lead to OOB - Internal
Object destructuring should track assignment in case of default value
…ng concurrent FindImplicitRoot calls - Individual
…s function parameter - Individual There are a few places where we are silently truncating the 24 bit CallInfo to 16 bits. It is possible in spread scenarios that we could use >16bits. I changed these shorts to uints and added the non-default warnings for truncation which would have found these issues.
… Inc. This change addresses a scenario where a deepCopy of a native array is needed when its head segment is already on the heap. In this case, it bypasses the previous fix because the head is on the stack and thus fails to do a deepCopy. The fix is to unconditionally reallocate both the array object and its segments when deepCopy is true.
|
@meg-gupta @pleath @agarwal-sandeep @leirocks @tcare @thomasmo @MikeHolman ... FYI... |
Modifying page protections cross-process is an issue, as attacker could possibly unmap JIT code and map in their own read/write memory where we expect JIT code, and trick JIT process into making it executable. To avoid this we need something to replace our ZeroMemory/VirtualProtectEx(PAGE_NOACCESS) method of mock-decommit (since files have no decommit support), as this later requires a VirtualProtectEx(PAGE_READEXECUTE) to recommit. The solution is to use VirtualUnlockEx, which will serve the same function for us.
MikeHolman
approved these changes
Mar 13, 2018
|
@MSLaguana fyi... |
leirocks
approved these changes
Mar 13, 2018
tcare
approved these changes
Mar 13, 2018
thomasmo
approved these changes
Mar 13, 2018
chakrabot
pushed a commit
that referenced
this pull request
Mar 13, 2018
chakrabot
pushed a commit
that referenced
this pull request
Mar 14, 2018
Merge pull request #4812 from akroshg:test1803_1 Pushing 18-03 changes.
chakrabot
pushed a commit
that referenced
this pull request
Mar 14, 2018
…rity updates Merge pull request #4812 from akroshg:test1803_1 Pushing 18-03 changes.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pushing 18-03 changes.