New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 1032 link

Starred by 1 user

Issue metadata

Status: Fixed
Last visit > 30 days ago
Closed: Mar 2017

Sign in to add a comment

Safari Browser: Builtin JavaScript allows Function.caller to be used in strict mode

Project Member Reported by, Dec 8 2016

Issue description

If a builtin script in webkit is in strict mode, but then calls a function that is not strict, this function is allowed to call Function.caller and can obtain a reference to the strict function. This is inconsistent with the behavior when executing non-builtin scripts in Safari, and the behavior in other browsers, where having a single strict function on the call stack forbids calls to Function.caller up to and including the first call to a strict function. This difference allows several sensitive native functions, such as arrayProtoPrivateFuncAppendMemcpy to be called directly, without the JavaScript wrappers that provide type and length checks.

A minimal example of this issue is as follows, and a full example is attached.

var q;
function g(){
	q = g.caller;
	return 7;

var a = [1, 2, 3];
a.length = 4;
Object.defineProperty(Array.prototype, "3", {get : g});
[4, 5, 6].concat(a);
q(0x77777777, 0x77777777, 0);

I strongly recommend this issue be fixed by changing the behaviour of Function.caller in strict mode, versus making changes to the natives, as it likely causes many similar problems 

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

420 bytes View Download
Project Member

Comment 1 by, Mar 9 2017

Labels: -Reported-2016-Dec-8 Reported-2016-Jan-5

Comment 2 by, Mar 16 2017

Labels: -Reported-2016-Jan-5 Reported-2017-Jan-5
Project Member

Comment 3 by, Mar 27 2017

Labels: CVE-2017-2446
Project Member

Comment 4 by, Mar 27 2017

Labels: -Restrict-View-Commit
Project Member

Comment 5 by, Mar 27 2017

Status: Fixed (was: New)

Comment 6 Deleted

Comment 7 Deleted

Sign in to add a comment