[cli] Fix the UAF with by-value receivers and --weak-refs

Fixes rustwasm#2447
getditto · Feb 5, 2021 · 785389d · 785389d
1 parent 69546a2
commit 785389d
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 6 deletions.
diff --git a/crates/cli-support/src/js/binding.rs b/crates/cli-support/src/js/binding.rs
@@ -124,15 +124,14 @@ impl<'a, 'b> Builder<'a, 'b> {
                 drop(params.next());
                 if js.cx.config.debug {
                     js.prelude(
-                        "if (this.ptr == 0) throw new Error('Attempt to use a moved value');\n",
+                        "if (this.ptr == 0) throw new Error('Attempt to use a moved value');",
                     );
                 }
                 if consumes_self {
-                    js.prelude("var ptr = this.ptr;");
-                    js.prelude("this.ptr = 0;");
-                    js.args.push("ptr".to_string());
+                    js.prelude("const ptr = this.__destroy_into_raw();");
+                    js.args.push("ptr".into());
                 } else {
-                    js.args.push("this.ptr".to_string());
+                    js.args.push("this.ptr".into());
                 }
             }
             None => {}

diff --git a/crates/cli-support/src/js/mod.rs b/crates/cli-support/src/js/mod.rs
@@ -846,10 +846,15 @@ impl<'a> Context<'a> {
 
         dst.push_str(&format!(
             "
-            free() {{
+            __destroy_into_raw() {{
                 const ptr = this.ptr;
                 this.ptr = 0;
                 {}
+                return ptr;
+            }}
+
+            free() {{
+                const ptr = this.__destroy_into_raw();
                 wasm.{}(ptr);
             }}
             ",