Skip to content

Commit 70cc64b

Browse files
gahaasmibrunin
authored andcommitted
[Backport] CVE-2024-1938: Type Confusion in V8
Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/5300311: Merged: [wasm] Use correct signature index for tier-up of wasm-to-js wrapper The wasm-to-js wrapper tierup used the canonicalized signature id lookup for module-independent signatures to look up the canonicalized signature id of module-specific signatures. With this CL the signature id is looked up with the function index of imported functions and from the dispatch table for indirect function calls instead. [email protected] Bug: 324596281 (cherry picked from commit 2109613ad4622028778a38fb418956fab8b478b6) Change-Id: I3fb7e4f02596f62e13ffe60015f96bac5efbc598 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5300311 Reviewed-by: Jakob Kummerow <[email protected]> Commit-Queue: Andreas Haas <[email protected]> Cr-Commit-Position: refs/branch-heads/12.2@{#32} Cr-Branched-From: 6eb5a9616aa6f8c705217aeb7c7ab8c037a2f676-refs/heads/12.2.281@{#1} Cr-Branched-From: 44cf56d850167c6988522f8981730462abc04bcc-refs/heads/main@{#91934} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/546082 Reviewed-by: Allan Sandfeld Jensen <[email protected]> Reviewed-by: Michal Klocek <[email protected]>
1 parent e403fbe commit 70cc64b

File tree

1 file changed

+24
-4
lines changed

1 file changed

+24
-4
lines changed

chromium/v8/src/runtime/runtime-wasm.cc

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
#include "src/wasm/wasm-constants.h"
2121
#include "src/wasm/wasm-debug.h"
2222
#include "src/wasm/wasm-engine.h"
23+
#include "src/wasm/wasm-module.h"
2324
#include "src/wasm/wasm-objects.h"
2425
#include "src/wasm/wasm-subtyping.h"
2526
#include "src/wasm/wasm-value.h"
@@ -470,10 +471,29 @@ RUNTIME_FUNCTION(Runtime_TierUpWasmToJSWrapper) {
470471
instance = handle(WasmInstanceObject::cast(tuple->value1()), isolate);
471472
origin = handle(tuple->value2(), isolate);
472473
}
473-
// Get the function's canonical signature index. Note that the function's
474-
// signature may not be present in the importing module.
475-
uint32_t canonical_sig_index =
476-
wasm::GetTypeCanonicalizer()->AddRecursiveGroup(&sig);
474+
475+
uint32_t canonical_sig_index = std::numeric_limits<uint32_t>::max();
476+
const wasm::WasmModule* module = instance->module();
477+
if (WasmApiFunctionRef::CallOriginIsImportIndex(origin)) {
478+
int func_index = WasmApiFunctionRef::CallOriginAsIndex(origin);
479+
canonical_sig_index =
480+
module->isorecursive_canonical_type_ids[module->functions[func_index]
481+
.sig_index];
482+
} else {
483+
// Indirect function table index.
484+
int entry_index = WasmApiFunctionRef::CallOriginAsIndex(origin);
485+
int table_count = instance->indirect_function_tables()->length();
486+
// We have to find the table which contains the correct entry.
487+
for (int table_index = 0; table_index < table_count; ++table_index) {
488+
Handle<WasmIndirectFunctionTable> table =
489+
instance->GetIndirectFunctionTable(isolate, table_index);
490+
if (table->refs()->get(entry_index) == *ref) {
491+
canonical_sig_index = table->sig_ids()->get(entry_index);
492+
break;
493+
}
494+
}
495+
}
496+
DCHECK_NE(canonical_sig_index, std::numeric_limits<uint32_t>::max());
477497

478498
// Compile a wrapper for the target callable.
479499
Handle<JSReceiver> callable(JSReceiver::cast(ref->callable()), isolate);

0 commit comments

Comments
 (0)