129768 CVE-2014-1362 2014-03-05 18:06:36 -0800 llint_slow_path_check_has_instance() should not adjust PC before accessing operands 2014-06-18 17:26:50 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam chai commit-queue fpizlo ggaren mhahnenberg mmirman msaboff oliver oldest_to_newest 987468 0 mark.lam 2014-03-05 18:06:36 -0800 When evaluating "a instanceof b" where b is an object that ImplementsHasInstance and OverridesHasInstance (e.g. a bound function), the LLINT will take the slow path llint_slow_path_check_has_instance(), and execute a code path that does the following: 1. Adjusts the byte code PC to the jump target PC. 2. For the purpose of storing the result, get the result registerIndex from the 1st operand using the PC as if the PC is still pointing to op_check_has_instance bytecode. The result is that whatever value resides after where the jump target PC is will be used as a result register value. Depending on what that value is, the result can be: 1. the code coincidently works correctly 2. memory corruption 3. crashes The fix is to only adjust the byte code PC after we have stored the result. ref: <rdar://problem/15394423> 987471 1 225934 mark.lam 2014-03-05 18:27:49 -0800 Created attachment 225934 the patch. 987472 2 mhahnenberg 2014-03-05 18:27:59 -0800 You should audit the other uses of LLINT_RETURN to make sure we're not doing this in any other places. 987473 3 mark.lam 2014-03-05 18:30:02 -0800 (In reply to comment #2) > You should audit the other uses of LLINT_RETURN to make sure we're not doing this in any other places. Already did. I audited adjustments made to the pc and made sure that they did not precede a LLINT_RETURN(). 987474 4 commit-queue 2014-03-05 18:30:09 -0800 Attachment 225934 did not pass style-queue: ERROR: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:125: __r_returnValue is incorrectly named. Don't use underscores in your identifier names. [readability/naming/underscores] [4] Total errors found: 1 in 5 files If any of these errors are false positives, please file a bug against check-webkit-style. 987475 5 mhahnenberg 2014-03-05 18:30:28 -0800 (In reply to comment #3) > (In reply to comment #2) > > You should audit the other uses of LLINT_RETURN to make sure we're not doing this in any other places. > > Already did. I audited adjustments made to the pc and made sure that they did not precede a LLINT_RETURN(). Cool :-) 987477 6 225934 mhahnenberg 2014-03-05 18:32:43 -0800 Comment on attachment 225934 the patch. r=me 987491 7 225934 commit-queue 2014-03-05 19:11:45 -0800 Comment on attachment 225934 the patch. Clearing flags on attachment: 225934 Committed r165162: <http://trac.webkit.org/changeset/165162> 987492 8 commit-queue 2014-03-05 19:11:48 -0800 All reviewed patches have been landed. Closing bug. 225934 2014-03-05 18:27:49 -0800 2014-03-05 19:11:45 -0800 the patch. bug-129768.patch text/plain 5892 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTY1MTU2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDMxIEBA CisyMDE0LTAzLTA1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBs bGludF9zbG93X3BhdGhfY2hlY2tfaGFzX2luc3RhbmNlKCkgc2hvdWxkIG5vdCBhZGp1c3QgUEMg YmVmb3JlIGFjY2Vzc2luZyBvcGVyYW5kcy4KKyAgICAgICAgPGh0dHBzOi8vd2Via2l0Lm9yZy9i LzEyOTc2OD4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICBXaGVuIGV2YWx1YXRpbmcgImEgaW5zdGFuY2VvZiBiIiB3aGVyZSBiIGlzIGFuIG9iamVjdCB0 aGF0IEltcGxlbWVudHNIYXNJbnN0YW5jZQorICAgICAgICBhbmQgT3ZlcnJpZGVzSGFzSW5zdGFu Y2UgKGUuZy4gYSBib3VuZCBmdW5jdGlvbiksIHRoZSBMTElOVCB3aWxsIHRha2UgdGhlIHNsb3cK KyAgICAgICAgcGF0aCBsbGludF9zbG93X3BhdGhfY2hlY2tfaGFzX2luc3RhbmNlKCksIGFuZCBl eGVjdXRlIGEgY29kZSBwYXRoIHRoYXQgZG9lcyB0aGUKKyAgICAgICAgZm9sbG93aW5nOgorICAg ICAgICAxLiBBZGp1c3RzIHRoZSBieXRlIGNvZGUgUEMgdG8gdGhlIGp1bXAgdGFyZ2V0IFBDLgor ICAgICAgICAyLiBGb3IgdGhlIHB1cnBvc2Ugb2Ygc3RvcmluZyB0aGUgcmVzdWx0LCBnZXQgdGhl IHJlc3VsdCByZWdpc3RlckluZGV4IGZyb20gdGhlCisgICAgICAgICAgIDFzdCBvcGVyYW5kIHVz aW5nIHRoZSBQQyBhcyBpZiB0aGUgUEMgaXMgc3RpbGwgcG9pbnRpbmcgdG8gb3BfY2hlY2tfaGFz X2luc3RhbmNlCisgICAgICAgICAgIGJ5dGVjb2RlLgorCisgICAgICAgIFRoZSByZXN1bHQgaXMg dGhhdCB3aGF0ZXZlciB2YWx1ZSByZXNpZGVzIGFmdGVyIHdoZXJlIHRoZSBqdW1wIHRhcmdldCBQ QyBpcyB3aWxsCisgICAgICAgIGJlIHVzZWQgYXMgYSByZXN1bHQgcmVnaXN0ZXIgdmFsdWUuICBE ZXBlbmRpbmcgb24gd2hhdCB0aGF0IHZhbHVlIGlzLCB0aGUgcmVzdWx0CisgICAgICAgIGNhbiBi ZToKKyAgICAgICAgMS4gdGhlIGNvZGUgY29pbmNpZGVudGx5IHdvcmtzIGNvcnJlY3RseQorICAg ICAgICAyLiBtZW1vcnkgY29ycnVwdGlvbgorICAgICAgICAzLiBjcmFzaGVzCisKKyAgICAgICAg VGhlIGZpeCBpcyB0byBvbmx5IGFkanVzdCB0aGUgYnl0ZSBjb2RlIFBDIGFmdGVyIHdlIGhhdmUg c3RvcmVkIHRoZSByZXN1bHQuCisgICAgICAgIAorICAgICAgICAqIGxsaW50L0xMSW50U2xvd1Bh dGhzLmNwcDoKKyAgICAgICAgKGxsaW50X3Nsb3dfcGF0aF9jaGVja19oYXNfaW5zdGFuY2UpOgor CiAyMDE0LTAzLTA1ICBHYXZpbiBCYXJyYWNsb3VnaCAgPGJhcnJhY2xvdWdoQGFwcGxlLmNvbT4K IAogICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTI4NjI1 CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvbGxpbnQvTExJbnRTbG93UGF0aHMuY3BwCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9MTEludFNsb3dQYXRocy5j cHAJKHJldmlzaW9uIDE2NTExMSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9MTElu dFNsb3dQYXRocy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTEyMSw2ICsxMjEsMTQgQEAgbmFtZXNw YWNlIEpTQyB7IG5hbWVzcGFjZSBMTEludCB7CiAgICAgICAgIExMSU5UX0VORF9JTVBMKCk7ICAg ICAgICAgICAgICAgICAgICAgICBcCiAgICAgfSB3aGlsZSAoZmFsc2UpCiAKKyNkZWZpbmUgTExJ TlRfUkVUVVJOX1dJVEhfUENfQURKVVNUTUVOVCh2YWx1ZSwgcGNBZGp1c3RtZW50KSBkbyB7IFwK KyAgICAgICAgSlNWYWx1ZSBfX3JfcmV0dXJuVmFsdWUgPSAodmFsdWUpOyAgICAgIFwKKyAgICAg ICAgTExJTlRfQ0hFQ0tfRVhDRVBUSU9OKCk7ICAgICAgICAgICAgICAgIFwKKyAgICAgICAgTExJ TlRfT1AoMSkgPSBfX3JfcmV0dXJuVmFsdWU7ICAgICAgICAgIFwKKyAgICAgICAgcGMgKz0gKHBj QWRqdXN0bWVudCk7ICAgICAgICAgICAgICAgICAgIFwKKyAgICAgICAgTExJTlRfRU5EX0lNUEwo KTsgICAgICAgICAgICAgICAgICAgICAgIFwKKyAgICB9IHdoaWxlIChmYWxzZSkKKwogI2RlZmlu ZSBMTElOVF9SRVRVUk5fUFJPRklMRUQob3Bjb2RlLCB2YWx1ZSkgZG8geyAgICAgICAgICAgICAg IFwKICAgICAgICAgSlNWYWx1ZSBfX3JwX3JldHVyblZhbHVlID0gKHZhbHVlKTsgICAgICAgICAg ICAgICAgICAgICBcCiAgICAgICAgIExMSU5UX0NIRUNLX0VYQ0VQVElPTigpOyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgXApAQCAtNTM1LDggKzU0Myw4IEBAIExMSU5UX1NMT1dfUEFU SF9ERUNMKHNsb3dfcGF0aF9jaGVja19oYXMKICAgICAgICAgSlNPYmplY3QqIGJhc2VPYmplY3Qg PSBhc09iamVjdChiYXNlVmFsKTsKICAgICAgICAgQVNTRVJUKCFiYXNlT2JqZWN0LT5zdHJ1Y3R1 cmUoKS0+dHlwZUluZm8oKS5pbXBsZW1lbnRzRGVmYXVsdEhhc0luc3RhbmNlKCkpOwogICAgICAg ICBpZiAoYmFzZU9iamVjdC0+c3RydWN0dXJlKCktPnR5cGVJbmZvKCkuaW1wbGVtZW50c0hhc0lu c3RhbmNlKCkpIHsKLSAgICAgICAgICAgIHBjICs9IHBjWzRdLnUub3BlcmFuZDsKLSAgICAgICAg ICAgIExMSU5UX1JFVFVSTihqc0Jvb2xlYW4oYmFzZU9iamVjdC0+bWV0aG9kVGFibGUoKS0+Y3Vz dG9tSGFzSW5zdGFuY2UoYmFzZU9iamVjdCwgZXhlYywgdmFsdWUpKSk7CisgICAgICAgICAgICBK U1ZhbHVlIHJlc3VsdCA9IGpzQm9vbGVhbihiYXNlT2JqZWN0LT5tZXRob2RUYWJsZSgpLT5jdXN0 b21IYXNJbnN0YW5jZShiYXNlT2JqZWN0LCBleGVjLCB2YWx1ZSkpOworICAgICAgICAgICAgTExJ TlRfUkVUVVJOX1dJVEhfUENfQURKVVNUTUVOVChyZXN1bHQsIHBjWzRdLnUub3BlcmFuZCk7CiAg ICAgICAgIH0KICAgICB9CiAgICAgTExJTlRfVEhST1coY3JlYXRlSW52YWxpZFBhcmFtZXRlckVy cm9yKGV4ZWMsICJpbnN0YW5jZW9mIiwgYmFzZVZhbCkpOwpJbmRleDogTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTY1 MTU2KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEs MTMgQEAKKzIwMTQtMDMtMDUgIE1hcmsgTGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgorCisgICAg ICAgIGxsaW50X3Nsb3dfcGF0aF9jaGVja19oYXNfaW5zdGFuY2UoKSBzaG91bGQgbm90IGFkanVz dCBQQyBiZWZvcmUgYWNjZXNzaW5nIG9wZXJhbmRzLgorICAgICAgICA8aHR0cHM6Ly93ZWJraXQu b3JnL2IvMTI5NzY4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgICoganMvaW5zdGFuY2VvZi1vcGVyYXRvci1leHBlY3RlZC50eHQ6CisgICAgICAgICog anMvc2NyaXB0LXRlc3RzL2luc3RhbmNlb2Ytb3BlcmF0b3IuanM6CisKIDIwMTQtMDMtMDUgIE9s aXZlciBIdW50ICA8b2xpdmVyQGFwcGxlLmNvbT4KIAogICAgICAgICBTdXBwb3J0IGNhY2hpbmcg b2YgY3VzdG9tIHNldHRlcnMKSW5kZXg6IExheW91dFRlc3RzL2pzL2luc3RhbmNlb2Ytb3BlcmF0 b3ItZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2pzL2luc3RhbmNlb2Yt b3BlcmF0b3ItZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAxNjUxMTEpCisrKyBMYXlvdXRUZXN0cy9q cy9pbnN0YW5jZW9mLW9wZXJhdG9yLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtNCw2 ICs0LDcgQEAgT24gc3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9mICJQQQogCiAKIFBB U1MgZ2V0dGVyQ2FsbGVkIGlzIGZhbHNlCitQQVNTIGZvbygpIGlzIGZhbHNlCiBQQVNTIHN1Y2Nl c3NmdWxseVBhcnNlZCBpcyB0cnVlCiAKIFRFU1QgQ09NUExFVEUKSW5kZXg6IExheW91dFRlc3Rz L2pzL3NjcmlwdC10ZXN0cy9pbnN0YW5jZW9mLW9wZXJhdG9yLmpzCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExh eW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0cy9pbnN0YW5jZW9mLW9wZXJhdG9yLmpzCShyZXZpc2lv biAxNjUxMTEpCisrKyBMYXlvdXRUZXN0cy9qcy9zY3JpcHQtdGVzdHMvaW5zdGFuY2VvZi1vcGVy YXRvci5qcwkod29ya2luZyBjb3B5KQpAQCAtOCwzICs4LDM0IEBAIHRyeSB7CiB9IGNhdGNoIChl KSB7CiB9CiBzaG91bGRCZUZhbHNlKCJnZXR0ZXJDYWxsZWQiKTsKKworLy8gUmVncmVzc2lvbiB0 ZXN0IGZvciA8aHR0cHM6Ly93ZWJraXQub3JnL2IvMTI5NzY4Pi4KKy8vIFRoaXMgdGVzdCBzaG91 bGQgbm90IGNyYXNoLgorZnVuY3Rpb24gZHVtbXlGdW5jdGlvbigpIHt9Cit2YXIgYyA9IGR1bW15 RnVuY3Rpb24uYmluZCgpOworCitmdW5jdGlvbiBmb28oKSB7CisgICAgLy8gVG8gcmVwcm9kdWNl IHRoZSBpc3N1ZSBvZiA8aHR0cHM6Ly93ZWJraXQub3JnL2IvMTI5NzY4Piwgd2UgbmVlZCB0byBk bworICAgIC8vIGFuIGluc3RhbmNlb2YgdGVzdCBhZ2FpbnN0IGFuIG9iamVjdCB0aGF0IGhhcyB0 aGUgZm9sbG93aW5nIGF0dHJpYnV0ZXM6CisgICAgLy8gSW1wbGVtZW50c0hhc0luc3RhbmNlLCBh bmQgT3ZlcnJpZGVzSGFzSW5zdGFuY2UuICBBIGJvdW5kIGZ1bmN0aW9uIGZpdHMKKyAgICAvLyB0 aGUgYmlsbC4KKyAgICB2YXIgcmVzdWx0ID0gYyBpbnN0YW5jZW9mIGM7CisKKyAgICAvLyBUaGlz IGlzIHdoZXJlIHRoZSBvcF9jaGVja19oYXNfaW5zdGFuY2UgYnl0ZWNvZGUganVtcHMgdG8gYWZ0 ZXIgdGhlCisgICAgLy8gaW5zdGFuY2VvZiB0ZXN0LiBBdCB0aGlzIGxvY2F0aW9uLCB3ZSBuZWVk IHRoZSB3b3JkIGF0IG9mZnNldCAxIHRvIGJlCisgICAgLy8gYSByaWRpY3Vsb3VzbHkgbGFyZ2Ug dmFsdWUgdGhhdCBjYW4ndCBiZSBhIHZhbGlkIHN0YWNrIHJlZ2lzdGVyIGluZGV4LgorICAgIC8v IFRvIGFjaGlldmUgdGhhdCwgd2UgdXNlIGFuIG9wX2xvb3BfaGludCBmb2xsb3dlZCBieSBhbnkg b3RoZXIgYnl0ZWNvZGUKKyAgICAvLyBpbnN0cnVjdGlvbi4gVGhlIG9wX2xvb3BfaGludCB0YWtl cyB1cCBleGFjdGx5IDEgd29yZCwgYW5kIHRoZSB3b3JkIGF0CisgICAgLy8gb2Zmc2V0IDEgdGhh dCBmb2xsb3dzIGFmdGVyIGlzIHRoZSBvcGNvZGUgb2YgdGhlIG5leHQgaW5zdHJ1Y3Rpb24uICBJ bgorICAgIC8vIHRoZSBMTElOVCwgdGhhdCBvcGNvZGUgdmFsdWUgd2lsbCBiZSBhIHBvaW50ZXIg dG8gdGhlIG9wY29kZSBoYW5kbGVyCisgICAgLy8gd2hpY2ggd2lsbCBiZSBsYXJnZSBhbmQgZXhh Y3RseSB3aGF0IHdlIG5lZWQuICBIZW5jZSwgd2UgcGxhbnQgYSBsb29wCisgICAgLy8gaGVyZSBm b3IgdGhlIG9wX2xvb3BfaGludCwgYW5kIGhhdmUgc29tZSBpbnN0cnVjdGlvbiBpbnNpZGUgdGhl IGxvb3AuCisgICAgd2hpbGUgKHRydWUpIHsKKyAgICAgICAgdmFyIGR1bW15MiA9IDEyMzQ1Njc4 OTsKKyAgICAgICAgYnJlYWs7CisgICAgfQorICAgIHJldHVybiByZXN1bHQ7Cit9CisKK3Nob3Vs ZEJlRmFsc2UoImZvbygpIik7CisK