Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change to address CVE-2016-7207 #1979

Merged
merged 1 commit into from
Nov 10, 2016
Merged

Change to address CVE-2016-7207 #1979

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 51 additions & 10 deletions lib/Parser/Parse.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,7 @@ Parser::Parser(Js::ScriptContext* scriptContext, BOOL strictMode, PageAllocator
m_nextFunctionId = nullptr;
m_errorCallback = nullptr;
m_uncertainStructure = FALSE;
m_reparsingLambdaParams = false;
currBackgroundParseItem = nullptr;
backgroundParseItems = nullptr;
fastScannedRegExpNodes = nullptr;
Expand Down Expand Up @@ -822,6 +823,14 @@ Symbol* Parser::AddDeclForPid(ParseNodePtr pnode, IdentPtr pid, SymbolType symbo
{
Error(ERRnoMemory);
}

if (refForDecl->funcId != GetCurrentFunctionNode()->sxFnc.functionId)
{
// Fix up the function id, which is incorrect if we're reparsing lambda parameters
Assert(this->m_reparsingLambdaParams);
refForDecl->funcId = GetCurrentFunctionNode()->sxFnc.functionId;
}

if (blockInfo == GetCurrentBlockInfo())
{
refForUse = refForDecl;
Expand Down Expand Up @@ -2879,7 +2888,12 @@ ParseNodePtr Parser::ParseTerm(BOOL fAllowCall,
}
}

ref = this->PushPidRef(pid);
// Don't push a reference if this is a single lambda parameter, because we'll reparse with
// a correct function ID.
if (m_token.tk != tkDArrow)
{
ref = this->PushPidRef(pid);
}

if (buildAST)
{
Expand Down Expand Up @@ -2910,6 +2924,7 @@ ParseNodePtr Parser::ParseTerm(BOOL fAllowCall,
break;

case tkLParen:
{
ichMin = m_pscan->IchMinTok();
iuMin = m_pscan->IecpMinTok();
m_pscan->Scan();
Expand All @@ -2933,11 +2948,27 @@ ParseNodePtr Parser::ParseTerm(BOOL fAllowCall,
break;
}

// Advance the block ID here in case this parenthetical expression turns out to be a lambda parameter list.
// That way the pid ref stacks will be created in their correct final form, and we can simply fix
// up function ID's.
uint saveNextBlockId = m_nextBlockId;
uint saveCurrBlockId = GetCurrentBlock()->sxBlock.blockId;
GetCurrentBlock()->sxBlock.blockId = m_nextBlockId++;

this->m_parenDepth++;
pnode = ParseExpr<buildAST>(koplNo, &fCanAssign, TRUE, FALSE, nullptr, nullptr /*nameLength*/, nullptr /*pShortNameOffset*/, &term, true);
this->m_parenDepth--;

ChkCurTok(tkRParen, ERRnoRparen);

GetCurrentBlock()->sxBlock.blockId = saveCurrBlockId;
if (m_token.tk == tkDArrow)
{
// We're going to rewind and reinterpret the expression as a parameter list.
// Put back the original next-block-ID so the existing pid ref stacks will be correct.
m_nextBlockId = saveNextBlockId;
}

// Emit a deferred ... error if one was parsed.
if (m_deferEllipsisError && m_token.tk != tkDArrow)
{
Expand All @@ -2949,6 +2980,7 @@ ParseNodePtr Parser::ParseTerm(BOOL fAllowCall,
m_deferEllipsisError = false;
}
break;
}

case tkIntCon:
if (IsStrictMode() && m_pscan->IsOctOrLeadingZeroOnLastTKNumber())
Expand Down Expand Up @@ -4974,7 +5006,13 @@ bool Parser::ParseFncDeclHelper(ParseNodePtr pnodeFnc, LPCOLESTR pNameHint, usho

if (!skipFormals)
{
bool fLambdaParamsSave = m_reparsingLambdaParams;
if (fLambda)
{
m_reparsingLambdaParams = true;
}
this->ParseFncFormals<buildAST>(pnodeFnc, flags);
m_reparsingLambdaParams = fLambdaParamsSave;
}

// Create function body scope
Expand Down Expand Up @@ -5039,22 +5077,17 @@ bool Parser::ParseFncDeclHelper(ParseNodePtr pnodeFnc, LPCOLESTR pNameHint, usho
{
if (paramScope->GetCanMergeWithBodyScope())
{
paramScope->ForEachSymbolUntil([this, paramScope](Symbol* sym) {
if (sym->GetPid()->GetTopRef()->sym == nullptr)
paramScope->ForEachSymbolUntil([this, paramScope, pnodeFnc](Symbol* sym) {
if (sym->GetPid()->GetTopRef()->GetFuncScopeId() > pnodeFnc->sxFnc.functionId)
{
// One of the symbol has non local reference. Mark the param scope as we can't merge it with body scope.
paramScope->SetCannotMergeWithBodyScope();
return true;
}
else
{
// If no non-local references are there then the top of the ref stack should point to the same symbol.
Assert(sym->GetPid()->GetTopRef()->sym == sym);
}
return false;
});

if (wellKnownPropertyPids.arguments->GetTopRef() && wellKnownPropertyPids.arguments->GetTopRef()->GetScopeId() > pnodeFnc->sxFnc.pnodeScopes->sxBlock.blockId)
if (wellKnownPropertyPids.arguments->GetTopRef() && wellKnownPropertyPids.arguments->GetTopRef()->GetFuncScopeId() > pnodeFnc->sxFnc.functionId)
{
Assert(pnodeFnc->sxFnc.UsesArguments());
// Arguments symbol is captured in the param scope
Expand Down Expand Up @@ -7962,7 +7995,7 @@ ParseNodePtr Parser::ParseExpr(int oplMin,
Error(ERRsyntax);
}
if (GetCurrentFunctionNode()->sxFnc.IsGenerator()
&& m_currentBlockInfo->pnodeBlock->sxBlock.blockType == PnodeBlockType::Parameter)
&& m_currentScope->GetScopeType() == ScopeType_Parameter)
{
Error(ERRsyntax);
}
Expand Down Expand Up @@ -8530,6 +8563,14 @@ PidRefStack* Parser::PushPidRef(IdentPtr pid)
}
pid->PushPidRef(blockId, funcId, ref);
}
else if (m_reparsingLambdaParams)
{
// If we're reparsing params, then we may have pid refs left behind from the first pass. Make sure we're
// working with the right ref at this point.
ref = this->FindOrAddPidRef(pid, blockId, funcId);
// Fix up the function ID if we're reparsing lambda parameters.
ref->funcId = funcId;
}

return ref;
}
Expand Down
1 change: 1 addition & 0 deletions lib/Parser/Parse.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,6 +367,7 @@ class Parser
ParseNodePtr * m_ppnodeVar; // variable list tail
bool m_inDeferredNestedFunc; // true if parsing a function in deferred mode, nested within the current node
bool m_isInBackground;
bool m_reparsingLambdaParams;

// This bool is used for deferring the shorthand initializer error ( {x = 1}) - as it is allowed in the destructuring grammar.
bool m_hasDeferredShorthandInitError;
Expand Down
22 changes: 22 additions & 0 deletions test/es6/lambda-params-shadow.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
//-------------------------------------------------------------------------------------------------------
// Copyright (C) Microsoft. All rights reserved.
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
//-------------------------------------------------------------------------------------------------------

var count = 0;
class A {
constructor() { count++; }
increment() { count++; }
}
class B extends A {
constructor() {
super();
((B) => { super.increment() })();
(A=> { super.increment() })();
}
}
let b = new B();
if (count !== 3) {
WScript.Echo('fail');
}
WScript.Echo('pass');
12 changes: 12 additions & 0 deletions test/es6/rlexe.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,18 @@
<compile-flags>-force:deferparse -args summary -endargs</compile-flags>
</default>
</test>
<test>
<default>
<files>lambda-params-shadow.js</files>
<compile-flags>-off:deferparse -args summary -endargs</compile-flags>
</default>
</test>
<test>
<default>
<files>lambda-params-shadow.js</files>
<compile-flags>-force:deferparse -args summary -endargs</compile-flags>
</default>
</test>
<test>
<default>
<files>NumericLiteralTest.js</files>
Expand Down