179392 2017-11-07 14:14:54 -0800 We should PROT_NONE the Gigacage runway so OOB accesses crash 2017-11-15 12:09:59 -0800 1 1 1 Unclassified WebKit JavaScriptCore Safari Technology Preview Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 saam saam benjamin commit-queue fpizlo ggaren gskachkov jfbastien keith_miller mark.lam msaboff rmorisset ticaiolima webkit-bug-importer ysuzuki oldest_to_newest 1369197 0 saam 2017-11-07 14:14:54 -0800 If we operate under the assumption that an attacker will exploit JSC and cause an OOB access, we should make such OOB accesses crash if they're in the gigacage runway. 1369227 1 326265 saam 2017-11-07 14:44:13 -0800 Created attachment 326265 patch 1369228 2 326265 mark.lam 2017-11-07 14:45:06 -0800 Comment on attachment 326265 patch r=me 1369251 3 326265 commit-queue 2017-11-07 15:31:25 -0800 Comment on attachment 326265 patch Clearing flags on attachment: 326265 Committed r224555: <https://trac.webkit.org/changeset/224555> 1369252 4 commit-queue 2017-11-07 15:31:27 -0800 All reviewed patches have been landed. Closing bug. 1372088 5 webkit-bug-importer 2017-11-15 12:09:59 -0800 <rdar://problem/35567063> 326265 2017-11-07 14:44:13 -0800 2017-11-07 15:31:25 -0800 patch b-backup.diff text/plain 1598 saam SW5kZXg6IFNvdXJjZS9ibWFsbG9jL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvYm1h bGxvYy9DaGFuZ2VMb2cJKHJldmlzaW9uIDIyNDU0OCkKKysrIFNvdXJjZS9ibWFsbG9jL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE3LTExLTA3ICBTYWFtIEJh cmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAgIFdlIHNob3VsZCBQUk9UX05PTkUg dGhlIEdpZ2FjYWdlIHJ1bndheSBzbyBPT0IgYWNjZXNzZXMgY3Jhc2gKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3OTM5MgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIElmIHdlIGFzc3VtZSB0aGF0IGFuIGF0 dGFja2VyIHdpbGwgZXhwbG9pdCBKU0MgYW5kIGNhdXNlIE9PQiBhY2Nlc3NlcywKKyAgICAgICAg d2Ugc2hvdWxkIG1ha2UgT09CIGFjY2Vzc2VzIGluIHRoZSBHaWdhY2FnZSBydW53YXkgY3Jhc2gu CisKKyAgICAgICAgKiBibWFsbG9jL0dpZ2FjYWdlLmNwcDoKKyAgICAgICAgKEdpZ2FjYWdlOjpl bnN1cmVHaWdhY2FnZSk6CisKIDIwMTctMTAtMzEgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxl LmNvbT4KIAogICAgICAgICBibWFsbG9jIHNob3VsZCBzdXBwb3J0IHN0cmljdGx5IHR5cGUtc2Vn cmVnYXRlZCBpc29sYXRlZCBoZWFwcwpJbmRleDogU291cmNlL2JtYWxsb2MvYm1hbGxvYy9HaWdh Y2FnZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL2JtYWxsb2MvYm1hbGxvYy9HaWdhY2FnZS5j cHAJKHJldmlzaW9uIDIyNDQ5OSkKKysrIFNvdXJjZS9ibWFsbG9jL2JtYWxsb2MvR2lnYWNhZ2Uu Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNTUsNiArMTU1LDEzIEBAIHZvaWQgZW5zdXJlR2lnYWNh Z2UoKQogICAgICAgICAgICAgICAgIGZwcmludGYoc3RkZXJyLCAiRkFUQUw6IENvdWxkIG5vdCBh bGxvY2F0ZSBnaWdhY2FnZSBtZW1vcnkgd2l0aCBtYXhBbGlnbm1lbnQgPSAlbHUsIHRvdGFsU2l6 ZSA9ICVsdS5cbiIsIG1heEFsaWdubWVudCwgdG90YWxTaXplKTsKICAgICAgICAgICAgICAgICBC Q1JBU0goKTsKICAgICAgICAgICAgIH0KKworICAgICAgICAgICAgaWYgKEdJR0FDQUdFX1JVTldB WSkgeworICAgICAgICAgICAgICAgIGNoYXIqIHJ1bndheSA9IHJlaW50ZXJwcmV0X2Nhc3Q8Y2hh cio+KGJhc2UpICsgdG90YWxTaXplIC0gR0lHQUNBR0VfUlVOV0FZOworICAgICAgICAgICAgICAg IC8vIE1ha2UgT09CIGFjY2Vzc2VzIGludG8gdGhlIHJ1bndheSBjcmFzaC4KKyAgICAgICAgICAg ICAgICB2bVJldm9rZVBlcm1pc3Npb25zKHJ1bndheSwgR0lHQUNBR0VfUlVOV0FZKTsKKyAgICAg ICAgICAgIH0KKwogICAgICAgICAgICAgdm1EZWFsbG9jYXRlUGh5c2ljYWxQYWdlcyhiYXNlLCB0 b3RhbFNpemUpOwogICAgICAgICAgICAgCiAgICAgICAgICAgICBzaXplX3QgbmV4dENhZ2UgPSAw Owo=