[CVE-2018-8291] DictionaryPropertyDescriptor::CopyFrom missed copying…

… some properties
chakra-core · Jul 10, 2018 · c322694 · c322694
1 parent 0cbed34
commit c322694
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/lib/Runtime/Types/DictionaryPropertyDescriptor.h b/lib/Runtime/Types/DictionaryPropertyDescriptor.h
@@ -274,8 +274,13 @@ namespace Js
         this->Setter = (descriptor.Setter == DictionaryPropertyDescriptor<TPropertyIndexFrom>::NoSlots) ? NoSlots : descriptor.Setter;
         this->IsAccessor = descriptor.IsAccessor;
 
+        // Not strictly required, PreventFalseReference must always be 1
+        this->PreventFalseReference = descriptor.PreventFalseReference;
+        this->IsShadowed = descriptor.IsShadowed;
+
 #if ENABLE_FIXED_FIELDS
         this->IsInitialized = descriptor.IsInitialized;
+        this->IsOnlyOneAccessorInitialized = descriptor.IsOnlyOneAccessorInitialized;
         this->IsFixed = descriptor.IsFixed;
         this->UsedAsFixed = descriptor.UsedAsFixed;
 #endif