Bug (CVE-2016-4733) – Memory Corruption in TypedArray.copyWithin

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Natalie Silvanovich]

Created attachment 282289 [details]
Sample file causing issue

There is a bug in TypedArray.copyWithin that can be used to write to an absolute pointer. 

In JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h, the function genericTypedArrayViewProtoFuncCopyWithin contains the following code:

    long length = thisObject->length();
    long to = argumentClampedIndexFromStartOrEnd(exec, 0, length);
    long from = argumentClampedIndexFromStartOrEnd(exec, 1, length);
    long final = argumentClampedIndexFromStartOrEnd(exec, 2, length, length);

    if (final < from)
        return JSValue::encode(exec->thisValue());

    long count = std::min(length - std::max(to, from), final - from);

    typename ViewClass::ElementType* array = thisObject->typedVector();
    memmove(array + to, array + from, count * thisObject->elementSize);

argumentClampedIndexFromStartOrEnd will call valueOf on a parameter to the copyWithin function, which can contain a function that neuters the this array, causing the variable "array" to be null. However, the "to" and "from" variables can be very large values, up to 0x7fffffff, which could be valid pointers on ARM and 32-bit platforms. This allows an absolute pointer in this range to be written to.

An HTML file demonstrating this issue is attached. This issue affects Safari Technology Preview and WebKit, but has not made it into production Safari yet (TypedArray.copyWithin is not supported).

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

--

[Our ref: https://bugs.chromium.org/p/project-zero/issues/detail?id=862]

Credit is to Natalie Silvanovich of Google Project Zero

[Radar WebKit Bug Importer]

<rdar://problem/27069149>

[Keith Miller]

Created attachment 282920 [details]
Patch

[Keith Miller]

Committed r202982: <http://trac.webkit.org/changeset/202982>

[Mark Lam]

*** Bug 159239 has been marked as a duplicate of this bug. ***