Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change to address CVE-2016-7287,CVE-2016-7286,CVE-2016-7288,CVE-2016-7296 #2230

Merged
merged 1 commit into from
Dec 17, 2016
Merged

Change to address CVE-2016-7287,CVE-2016-7286,CVE-2016-7288,CVE-2016-7296 #2230

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 24 additions & 13 deletions lib/Runtime/Library/IntlEngineInterfaceExtensionObject.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,35 +295,46 @@ namespace Js

void IntlEngineInterfaceExtensionObject::deletePrototypePropertyHelper(ScriptContext* scriptContext, DynamicObject* intlObject, Js::PropertyId objectPropertyId, Js::PropertyId getterFunctionId)
{
DynamicObject *prototypeVal = nullptr;
DynamicObject *prototypeObject = nullptr;
DynamicObject *functionObj = nullptr;
Var propertyValue;
Var getter;
Var setter;
Var propertyValue = nullptr;
Var prototypeValue = nullptr;
Var resolvedOptionsValue = nullptr;
Var getter = nullptr;
Var setter = nullptr;

if (!Js::JavascriptOperators::GetProperty(intlObject, objectPropertyId, &propertyValue, scriptContext))
if (!JavascriptOperators::GetProperty(intlObject, objectPropertyId, &propertyValue, scriptContext) ||
!JavascriptOperators::IsObject(propertyValue))
{
AssertMsg(false, "Error.");
return;
}

if (!Js::JavascriptOperators::GetProperty(DynamicObject::FromVar(propertyValue), Js::PropertyIds::prototype, &propertyValue, scriptContext))
if (!JavascriptOperators::GetProperty(DynamicObject::FromVar(propertyValue), Js::PropertyIds::prototype, &prototypeValue, scriptContext) ||
!JavascriptOperators::IsObject(prototypeValue))
{
AssertMsg(false, "Can't be null, otherwise Intl library wasn't initialized correctly");
return;
}

if (!Js::JavascriptOperators::GetProperty(prototypeVal = DynamicObject::FromVar(propertyValue), Js::PropertyIds::resolvedOptions, &propertyValue, scriptContext))
prototypeObject = DynamicObject::FromVar(prototypeValue);

if (!JavascriptOperators::GetProperty(prototypeObject, Js::PropertyIds::resolvedOptions, &resolvedOptionsValue, scriptContext) ||
!JavascriptOperators::IsObject(resolvedOptionsValue))
{
AssertMsg(false, "If these operations result in false, Intl tests will detect them");
return;
}

(functionObj = DynamicObject::FromVar(propertyValue))->SetConfigurable(Js::PropertyIds::prototype, true);
functionObj = DynamicObject::FromVar(resolvedOptionsValue);
functionObj->SetConfigurable(Js::PropertyIds::prototype, true);
functionObj->DeleteProperty(Js::PropertyIds::prototype, Js::PropertyOperationFlags::PropertyOperation_None);

JavascriptOperators::GetOwnAccessors(prototypeVal, getterFunctionId, &getter, &setter, scriptContext);
(functionObj = DynamicObject::FromVar(getter))->SetConfigurable(Js::PropertyIds::prototype, true);
if (!JavascriptOperators::GetOwnAccessors(prototypeObject, getterFunctionId, &getter, &setter, scriptContext) ||
!JavascriptOperators::IsObject(getter))
{
return;
}

functionObj = DynamicObject::FromVar(getter);
functionObj->SetConfigurable(Js::PropertyIds::prototype, true);
functionObj->DeleteProperty(Js::PropertyIds::prototype, Js::PropertyOperationFlags::PropertyOperation_None);
}

Expand Down
5 changes: 3 additions & 2 deletions lib/Runtime/Library/JavascriptFunction.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -989,15 +989,16 @@ namespace Js

if (arr != nullptr && !arr->IsCrossSiteObject())
{
uint32 length = arr->GetLength();
// CONSIDER: Optimize by creating a JavascriptArray routine which allows
// memcpy-like semantics in optimal situations (no gaps, etc.)
if (argsIndex + arr->GetLength() > destArgs.Info.Count)
if (argsIndex + length > destArgs.Info.Count)
{
AssertMsg(false, "The array length has changed since we allocated the destArgs buffer?");
Throw::FatalInternalError();
}

for (uint32 j = 0; j < arr->GetLength(); j++)
for (uint32 j = 0; j < length; j++)
{
Var element;
if (!arr->DirectGetItemAtFull(j, &element))
Expand Down
46 changes: 24 additions & 22 deletions lib/Runtime/Library/JavascriptSimdObject.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ namespace Js
}

template <typename T, size_t N>
Var JavascriptSIMDObject::ToLocaleString(const Var* args, uint numArgs, const char16 *typeString, const T (&laneValues)[N],
Var JavascriptSIMDObject::ToLocaleString(const Var* args, uint numArgs, const char16 *typeString, const T(&laneValues)[N],
CallInfo* callInfo, ScriptContext* scriptContext) const
{
Assert(args);
Expand All @@ -159,23 +159,26 @@ namespace Js
return ToString(scriptContext); //Boolean types does not have toLocaleString.
}

// Clamp to the first 3 arguments - we'll ignore more.
if (numArgs > 3)
{
numArgs = 3;
}

// Creating a new arguments list for the JavascriptNumber generated from each lane.The optional SIMDToLocaleString Args are
//added to this argument list.
Var* newArgs = HeapNewArray(Var, numArgs);
switch (numArgs)
Var newArgs[3] = { nullptr, nullptr, nullptr };
CallInfo newCallInfo((ushort)numArgs);

if (numArgs > 1)
{
case 1:
break;
case 2:
newArgs[1] = args[1];
break;
case 3:
newArgs[1] = args[1];
}
if (numArgs > 2)
{
newArgs[2] = args[2];
break;
default:
Assert(UNREACHED);
}

//Locale specifc seperator??
JavascriptString *seperator = JavascriptString::NewWithSz(_u(", "), scriptContext);
uint idx = 0;
Expand All @@ -184,7 +187,7 @@ namespace Js
char16* stringBuffer = AnewArray(tempAllocator, char16, SIMD_STRING_BUFFER_MAX);
JavascriptString *result = nullptr;

swprintf_s(stringBuffer, 1024, typeString);
swprintf_s(stringBuffer, SIMD_STRING_BUFFER_MAX, typeString);
result = JavascriptString::NewCopySzFromArena(stringBuffer, scriptContext, scriptContext->GeneralAllocator());

if (typeDescriptor == TypeIds_SIMDFloat32x4)
Expand All @@ -193,44 +196,43 @@ namespace Js
{
laneVar = JavascriptNumber::ToVarWithCheck(laneValues[idx], scriptContext);
newArgs[0] = laneVar;
JavascriptString *laneValue = JavascriptNumber::ToLocaleStringIntl(newArgs, *callInfo, scriptContext);
JavascriptString *laneValue = JavascriptNumber::ToLocaleStringIntl(newArgs, newCallInfo, scriptContext);
result = JavascriptString::Concat(result, laneValue);
result = JavascriptString::Concat(result, seperator);
}
laneVar = JavascriptNumber::ToVarWithCheck(laneValues[idx], scriptContext);
newArgs[0] = laneVar;
result = JavascriptString::Concat(result, JavascriptNumber::ToLocaleStringIntl(newArgs, *callInfo, scriptContext));
result = JavascriptString::Concat(result, JavascriptNumber::ToLocaleStringIntl(newArgs, newCallInfo, scriptContext));
}
else if (typeDescriptor == TypeIds_SIMDInt8x16 || typeDescriptor == TypeIds_SIMDInt16x8 || typeDescriptor == TypeIds_SIMDInt32x4)
{
for (; idx < numLanes - 1; ++idx)
{
laneVar = JavascriptNumber::ToVar(static_cast<int>(laneValues[idx]), scriptContext);
laneVar = JavascriptNumber::ToVar(static_cast<int>(laneValues[idx]), scriptContext);
newArgs[0] = laneVar;
JavascriptString *laneValue = JavascriptNumber::ToLocaleStringIntl(newArgs, *callInfo, scriptContext);
JavascriptString *laneValue = JavascriptNumber::ToLocaleStringIntl(newArgs, newCallInfo, scriptContext);
result = JavascriptString::Concat(result, laneValue);
result = JavascriptString::Concat(result, seperator);
}
laneVar = JavascriptNumber::ToVar(static_cast<int>(laneValues[idx]), scriptContext);
newArgs[0] = laneVar;
result = JavascriptString::Concat(result, JavascriptNumber::ToLocaleStringIntl(newArgs, *callInfo, scriptContext));
result = JavascriptString::Concat(result, JavascriptNumber::ToLocaleStringIntl(newArgs, newCallInfo, scriptContext));
}
else
{
Assert((typeDescriptor == TypeIds_SIMDUint8x16 || typeDescriptor == TypeIds_SIMDUint16x8 || typeDescriptor == TypeIds_SIMDUint32x4));
for (; idx < numLanes - 1; ++idx)
{
laneVar = JavascriptNumber::ToVar(static_cast<uint>(laneValues[idx]), scriptContext);
laneVar = JavascriptNumber::ToVar(static_cast<uint>(laneValues[idx]), scriptContext);
newArgs[0] = laneVar;
JavascriptString *laneValue = JavascriptNumber::ToLocaleStringIntl(newArgs, *callInfo, scriptContext);
JavascriptString *laneValue = JavascriptNumber::ToLocaleStringIntl(newArgs, newCallInfo, scriptContext);
result = JavascriptString::Concat(result, laneValue);
result = JavascriptString::Concat(result, seperator);
}
laneVar = JavascriptNumber::ToVar(static_cast<uint>(laneValues[idx]), scriptContext);
newArgs[0] = laneVar;
result = JavascriptString::Concat(result, JavascriptNumber::ToLocaleStringIntl(newArgs, *callInfo, scriptContext));
result = JavascriptString::Concat(result, JavascriptNumber::ToLocaleStringIntl(newArgs, newCallInfo, scriptContext));
}
HeapDeleteArray(numArgs, newArgs);
END_TEMP_ALLOCATOR(tempAllocator, scriptContext);
return JavascriptString::Concat(result, JavascriptString::NewWithSz(_u(")"), scriptContext));
}
Expand Down
83 changes: 79 additions & 4 deletions lib/Runtime/Library/SimdFloat32x4Lib.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1092,8 +1092,26 @@ namespace Js
AssertMsg(args.Info.Count > 0, "Should always have implicit 'this'");
Assert(!(callInfo.Flags & CallFlags_New));

Var tarray;
Var index;
if (args.Info.Count > 1)
{
tarray = args[1];
}
else
{
tarray = scriptContext->GetLibrary()->GetUndefined();
}
if (args.Info.Count > 2)
{
index = args[2];
}
else
{
index = scriptContext->GetLibrary()->GetUndefined();
}

return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(args[1], args[2], 4 * FLOAT32_SIZE, scriptContext);
return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(tarray, index, 4 * FLOAT32_SIZE, scriptContext);
}

Var SIMDFloat32x4Lib::EntryLoad1(RecyclableObject* function, CallInfo callInfo, ...)
Expand All @@ -1106,7 +1124,26 @@ namespace Js
AssertMsg(args.Info.Count > 0, "Should always have implicit 'this'");
Assert(!(callInfo.Flags & CallFlags_New));

return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(args[1], args[2], 1 * FLOAT32_SIZE, scriptContext);
Var tarray;
Var index;
if (args.Info.Count > 1)
{
tarray = args[1];
}
else
{
tarray = scriptContext->GetLibrary()->GetUndefined();
}
if (args.Info.Count > 2)
{
index = args[2];
}
else
{
index = scriptContext->GetLibrary()->GetUndefined();
}

return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(tarray, index, 1 * FLOAT32_SIZE, scriptContext);
}

Var SIMDFloat32x4Lib::EntryLoad2(RecyclableObject* function, CallInfo callInfo, ...)
Expand All @@ -1119,7 +1156,26 @@ namespace Js
AssertMsg(args.Info.Count > 0, "Should always have implicit 'this'");
Assert(!(callInfo.Flags & CallFlags_New));

return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(args[1], args[2], 2 * FLOAT32_SIZE, scriptContext);
Var tarray;
Var index;
if (args.Info.Count > 1)
{
tarray = args[1];
}
else
{
tarray = scriptContext->GetLibrary()->GetUndefined();
}
if (args.Info.Count > 2)
{
index = args[2];
}
else
{
index = scriptContext->GetLibrary()->GetUndefined();
}

return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(tarray, index, 2 * FLOAT32_SIZE, scriptContext);
}

Var SIMDFloat32x4Lib::EntryLoad3(RecyclableObject* function, CallInfo callInfo, ...)
Expand All @@ -1132,7 +1188,26 @@ namespace Js
AssertMsg(args.Info.Count > 0, "Should always have implicit 'this'");
Assert(!(callInfo.Flags & CallFlags_New));

return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(args[1], args[2], 3 * FLOAT32_SIZE, scriptContext);
Var tarray;
Var index;
if (args.Info.Count > 1)
{
tarray = args[1];
}
else
{
tarray = scriptContext->GetLibrary()->GetUndefined();
}
if (args.Info.Count > 2)
{
index = args[2];
}
else
{
index = scriptContext->GetLibrary()->GetUndefined();
}

return SIMD128TypedArrayLoad<JavascriptSIMDFloat32x4>(tarray, index, 3 * FLOAT32_SIZE, scriptContext);
}

Var SIMDFloat32x4Lib::EntryStore(RecyclableObject* function, CallInfo callInfo, ...)
Expand Down
42 changes: 40 additions & 2 deletions lib/Runtime/Library/SimdFloat64x2Lib.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -873,7 +873,26 @@ namespace Js
AssertMsg(args.Info.Count > 0, "Should always have implicit 'this'");
Assert(!(callInfo.Flags & CallFlags_New));

return SIMD128TypedArrayLoad<JavascriptSIMDFloat64x2>(args[1], args[2], 2 * FLOAT64_SIZE, scriptContext);
Var tarray;
Var index;
if (args.Info.Count > 1)
{
tarray = args[1];
}
else
{
tarray = scriptContext->GetLibrary()->GetUndefined();
}
if (args.Info.Count > 2)
{
index = args[2];
}
else
{
index = scriptContext->GetLibrary()->GetUndefined();
}

return SIMD128TypedArrayLoad<JavascriptSIMDFloat64x2>(tarray, index, 2 * FLOAT64_SIZE, scriptContext);
}

Var SIMDFloat64x2Lib::EntryLoad1(RecyclableObject* function, CallInfo callInfo, ...)
Expand All @@ -886,7 +905,26 @@ namespace Js
AssertMsg(args.Info.Count > 0, "Should always have implicit 'this'");
Assert(!(callInfo.Flags & CallFlags_New));

return SIMD128TypedArrayLoad<JavascriptSIMDFloat64x2>(args[1], args[2], 1 * FLOAT64_SIZE, scriptContext);
Var tarray;
Var index;
if (args.Info.Count > 1)
{
tarray = args[1];
}
else
{
tarray = scriptContext->GetLibrary()->GetUndefined();
}
if (args.Info.Count > 2)
{
index = args[2];
}
else
{
index = scriptContext->GetLibrary()->GetUndefined();
}

return SIMD128TypedArrayLoad<JavascriptSIMDFloat64x2>(tarray, index, 1 * FLOAT64_SIZE, scriptContext);
}

Var SIMDFloat64x2Lib::EntryStore(RecyclableObject* function, CallInfo callInfo, ...)
Expand Down
20 changes: 19 additions & 1 deletion lib/Runtime/Library/SimdInt16x8Lib.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,8 +703,26 @@ namespace Js
AssertMsg(args.Info.Count > 0, "Should always have implicit 'this'");
Assert(!(callInfo.Flags & CallFlags_New));

Var tarray;
Var index;
if (args.Info.Count > 1)
{
tarray = args[1];
}
else
{
tarray = scriptContext->GetLibrary()->GetUndefined();
}
if (args.Info.Count > 2)
{
index = args[2];
}
else
{
index = scriptContext->GetLibrary()->GetUndefined();
}

return SIMD128TypedArrayLoad<JavascriptSIMDInt16x8>(args[1], args[2], 8 * INT16_SIZE, scriptContext);
return SIMD128TypedArrayLoad<JavascriptSIMDInt16x8>(tarray, index, 8 * INT16_SIZE, scriptContext);
}

Var SIMDInt16x8Lib::EntryStore(RecyclableObject* function, CallInfo callInfo, ...)
Expand Down
Loading