[CVE-2017-0093] Type confusion in asm.js arguments

Cellule · rajatd · commit 303d997b65fa · 2017-04-13T12:49:46.000-07:00
When calling eval we pass an additional argument to the function. If we've assigned an asm.js function to eval, then we need to remove that additional argument before getting the arguments
diff --git a/lib/Runtime/Language/AsmJsUtils.cpp b/lib/Runtime/Language/AsmJsUtils.cpp
@@ -217,7 +217,8 @@ namespace Js
 
         AsmJsModuleInfo::EnsureHeapAttached(func);
 
-        uint actualArgCount = callInfo.Count - 1; // -1 for ScriptFunction
+        ArgumentReader reader(&callInfo, origArgs);
+        uint actualArgCount = reader.Info.Count - 1; // -1 for ScriptFunction
         argDst = argDst + MachPtr; // add one first so as to skip the ScriptFunction argument
         for (ArgSlot i = 0; i < info->GetArgCount(); i++)
         {
diff --git a/test/AsmJs/evalbug.js b/test/AsmJs/evalbug.js
@@ -0,0 +1,18 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function asm() {
+  "use asm"
+  function f(a, b) {
+    a = a|0;
+    b = b|0;
+    return a|0;
+  }
+  return f;
+}
+
+eval = asm();
+eval("some string");
+print("PASSED");
diff --git a/test/AsmJs/rlexe.xml b/test/AsmJs/rlexe.xml
@@ -536,6 +536,11 @@
       <compile-flags>-testtrace:asmjs -simdjs</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>evalbug.js</files>
+    </default>
+  </test>
   <test>
     <default>
       <files>constTest.js</files>

Original file line number	Diff line number	Diff line change
`@@ -217,7 +217,8 @@ namespace Js`
`217`	`217`
`218`	`218`	`AsmJsModuleInfo::EnsureHeapAttached(func);`
`219`	`219`
`220`		`- uint actualArgCount = callInfo.Count - 1; // -1 for ScriptFunction`
	`220`	`+ ArgumentReader reader(&callInfo, origArgs);`
	`221`	`+ uint actualArgCount = reader.Info.Count - 1; // -1 for ScriptFunction`
`221`	`222`	`argDst = argDst + MachPtr; // add one first so as to skip the ScriptFunction argument`
`222`	`223`	`for (ArgSlot i = 0; i < info->GetArgCount(); i++)`
`223`	`224`	`{`