Skip to content

Commit f06ec04

Browse files
isheludkomibrunin
authored andcommitted
[Backport] CVE-2021-21225: Out of bounds memory access in V8 (1/2)
Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/2823829: [LTS-M86][builtins] Fix Array.prototype.concat with @@species (cherry picked from commit 7989e04979c3195e60a6814e8263063eb91f7b47) No-Try: true No-Presubmit: true No-Tree-Checks: true Bug: chromium:1195977 Change-Id: I16843bce2e9f776abca0f2b943b898ab5e597e42 Reviewed-by: Camillo Bruni <[email protected]> Commit-Queue: Igor Sheludko <[email protected]> Cr-Original-Commit-Position: refs/heads/master@{#73842} Commit-Queue: Jana Grill <[email protected]> Reviewed-by: Igor Sheludko <[email protected]> Reviewed-by: Victor-Gabriel Savu <[email protected]> Cr-Commit-Position: refs/branch-heads/8.6@{#77} Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1} Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472} Reviewed-by: Allan Sandfeld Jensen <[email protected]>
1 parent d217134 commit f06ec04

File tree

2 files changed

+13
-8
lines changed

2 files changed

+13
-8
lines changed

chromium/v8/src/builtins/builtins-array.cc

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -649,11 +649,14 @@ class ArrayConcatVisitor {
649649
index_offset_(0u),
650650
bit_field_(FastElementsField::encode(fast_elements) |
651651
ExceedsLimitField::encode(false) |
652-
IsFixedArrayField::encode(storage->IsFixedArray()) |
652+
IsFixedArrayField::encode(storage->IsFixedArray(isolate)) |
653653
HasSimpleElementsField::encode(
654-
storage->IsFixedArray() ||
655-
!storage->map().IsCustomElementsReceiverMap())) {
656-
DCHECK(!(this->fast_elements() && !is_fixed_array()));
654+
storage->IsFixedArray(isolate) ||
655+
// Don't take fast path for storages that might have
656+
// side effects when storing to them.
657+
(!storage->map(isolate).IsCustomElementsReceiverMap() &&
658+
!storage->IsJSTypedArray(isolate)))) {
659+
DCHECK_IMPLIES(this->fast_elements(), is_fixed_array());
657660
}
658661

659662
~ArrayConcatVisitor() { clear_storage(); }
@@ -1063,8 +1066,8 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
10631066
return IterateElementsSlow(isolate, receiver, length, visitor);
10641067
}
10651068

1066-
if (!HasOnlySimpleElements(isolate, *receiver) ||
1067-
!visitor->has_simple_elements()) {
1069+
if (!visitor->has_simple_elements() ||
1070+
!HasOnlySimpleElements(isolate, *receiver)) {
10681071
return IterateElementsSlow(isolate, receiver, length, visitor);
10691072
}
10701073
Handle<JSObject> array = Handle<JSObject>::cast(receiver);

chromium/v8/src/objects/fixed-array-inl.h

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -336,15 +336,15 @@ int Search(T* array, Name name, int valid_entries, int* out_insertion_index,
336336
double FixedDoubleArray::get_scalar(int index) {
337337
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
338338
map() != GetReadOnlyRoots().fixed_array_map());
339-
DCHECK(index >= 0 && index < this->length());
339+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
340340
DCHECK(!is_the_hole(index));
341341
return ReadField<double>(kHeaderSize + index * kDoubleSize);
342342
}
343343

344344
uint64_t FixedDoubleArray::get_representation(int index) {
345345
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
346346
map() != GetReadOnlyRoots().fixed_array_map());
347-
DCHECK(index >= 0 && index < this->length());
347+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
348348
int offset = kHeaderSize + index * kDoubleSize;
349349
// Bug(v8:8875): Doubles may be unaligned.
350350
return base::ReadUnalignedValue<uint64_t>(field_address(offset));
@@ -362,6 +362,7 @@ Handle<Object> FixedDoubleArray::get(FixedDoubleArray array, int index,
362362
void FixedDoubleArray::set(int index, double value) {
363363
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
364364
map() != GetReadOnlyRoots().fixed_array_map());
365+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
365366
int offset = kHeaderSize + index * kDoubleSize;
366367
if (std::isnan(value)) {
367368
WriteField<double>(offset, std::numeric_limits<double>::quiet_NaN());
@@ -378,6 +379,7 @@ void FixedDoubleArray::set_the_hole(Isolate* isolate, int index) {
378379
void FixedDoubleArray::set_the_hole(int index) {
379380
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
380381
map() != GetReadOnlyRoots().fixed_array_map());
382+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
381383
int offset = kHeaderSize + index * kDoubleSize;
382384
base::WriteUnalignedValue<uint64_t>(field_address(offset), kHoleNanInt64);
383385
}

0 commit comments

Comments
 (0)