[CVE-2019-1237]

chakra-core · Sep 9, 2019 · 31f2588 · 31f2588
1 parent b75847e
commit 31f2588
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/lib/Runtime/Library/BoundFunction.cpp b/lib/Runtime/Library/BoundFunction.cpp
@@ -354,6 +354,12 @@ namespace Js
             Var varLength;
             if (targetFunction->GetProperty(targetFunction, PropertyIds::length, &varLength, nullptr, requestContext))
             {
+                if (!TaggedInt::Is(varLength))
+                {
+                    // ToInt32 conversion on non-primitive length can invalidate assumptions made by the JIT,
+                    // so add implicit call flag if length isn't a TaggedInt already
+                    requestContext->GetThreadContext()->AddImplicitCallFlags(ImplicitCall_Accessor);
+                }
                 len = JavascriptConversion::ToInt32(varLength, requestContext);
             }