New issue
Advanced search Search tips

Issue 1569 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jul 11
Cc:



Sign in to add a comment

Microsoft Edge: Chakra: A bug in BoundFunction::NewInstance

Project Member Reported by lokihardt@google.com, May 4 2018

Issue description

BoundFunction::NewInstance is used to handle calls to a bound function. The method first allocates a new argument array and copies the prepended arguments and others into the new argument array and calls the actual function. The problem is, it doesn't care about the CallFlags_ExtraArg flag which indicates that there's an extra argument (new.target in the PoC) at the end of the argument array. So the size of the new argument array created with the CallFlags_ExtraArg flag will be always 1 less then required, this leads to an OOB read.

PoC:
function func() {
    new.target.x;
}

let bound = func.bind({}, 1);

Reflect.construct(bound, []);



This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.

 
Project Member

Comment 1 by lokihardt@google.com, May 17 2018

Description: Show this description
Project Member

Comment 2 by lokihardt@google.com, Jul 11

Labels: CVE-2018-8139
Status: Fixed (was: New)

Comment 3 Deleted

Project Member

Comment 4 by lokihardt@google.com, Jul 11

Labels: -Restrict-View-Commit

Sign in to add a comment