17-03 ChakraCore servicing release #2697
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
…en using a Symbol When setting a property trap with JavascriptProxy::SetPropertyTrap using a symbol as a property id, we incorrectly assume that JavascriptProxy::GetName returns a PropertyString. The case for a JavascriptSymbol is unhandled, and we do a static cast leading to type confusion. Fix is to handle any cases other than PropertyString by using nullptr, as is the convention elsewhere.
…array if the bailout kind tells us to bail out on helper calls.
This change promotes several asserts to failfasts, and adds two additional ones, in order to ensure that no post-lower opcodes are added earlier than the lowerer phase, either by being added to the incoming bytecode buffer, or by corrupting a part of the IR during the earlier phases of the JIT.
…hen asm.js parse fails
…ConcatSpreadable Signed-off-by: Michael Holman <Michael.Holman@microsoft.com>
…l list instead of parse node index.
…async arrow function.
The MissingItem check is happening on the array in a loop. It is possible that we get called into script and that mutates the array. So the Array's head is newly created with length. However the loop is still performing over the old length. Fixed this by checking the length In IsMissingItem function. Added a unittest.
…n param scope In a function expression with name, where the name is captured in one of the param scope functions, if there is a function or var declaration with the same name as the function expression name we were marking the function expression name as shadowed. In non-eval case this causes issue because the name symbol won't get added to the body. This change is to fix it in such a way if the name is captured in the param scope then we split the param and body scope such that the name symbol is added to the param scope not body scope.
MikeHolman force-pushed the release/1703 branch from ecea51d to 9da0194 Compare Contributor Author
Contributor
| My 2 commits look good. |
Contributor
| LGTM. |
Contributor
| LGTM |
1 similar comment
Contributor
| LGTM |
| LGTM |
1 similar comment
Contributor
| LGTM |
chakrabot pushed a commit that referenced this pull request Mar 16, 2017
Merge pull request #2697 from MikeHolman:release/1703 Fixes the following CVEs impacting ChakraCore: CVE-2017-0067 CVE-2017-0150 CVE-2017-0138 CVE-2017-0094 CVE-2017-0132 CVE-2017-0133 CVE-2017-0134 CVE-2017-0137 CVE-2017-0071 CVE-2017-0151 CVE-2017-0141 CVE-2017-0196 CVE-2017-0136 CVE-2017-0152 CVE-2017-0010 CVE-2017-0035 CVE-2017-0015 CVE-2017-0028
chakrabot pushed a commit that referenced this pull request Mar 17, 2017
Merge pull request #2697 from MikeHolman:release/1703 Fixes the following CVEs impacting ChakraCore: CVE-2017-0067 CVE-2017-0150 CVE-2017-0138 CVE-2017-0094 CVE-2017-0132 CVE-2017-0133 CVE-2017-0134 CVE-2017-0137 CVE-2017-0071 CVE-2017-0151 CVE-2017-0141 CVE-2017-0196 CVE-2017-0136 CVE-2017-0152 CVE-2017-0010 CVE-2017-0035 CVE-2017-0015 CVE-2017-0028
chakrabot pushed a commit that referenced this pull request Mar 17, 2017
…vicing release Merge pull request #2697 from MikeHolman:release/1703 Fixes the following CVEs impacting ChakraCore: CVE-2017-0067 CVE-2017-0150 CVE-2017-0138 CVE-2017-0094 CVE-2017-0132 CVE-2017-0133 CVE-2017-0134 CVE-2017-0137 CVE-2017-0071 CVE-2017-0151 CVE-2017-0141 CVE-2017-0196 CVE-2017-0136 CVE-2017-0152 CVE-2017-0010 CVE-2017-0035 CVE-2017-0015 CVE-2017-0028
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Fixes the following CVEs impacting ChakraCore:
CVE-2017-0067
CVE-2017-0150
CVE-2017-0138
CVE-2017-0094
CVE-2017-0132
CVE-2017-0133
CVE-2017-0134
CVE-2017-0137
CVE-2017-0071
CVE-2017-0151
CVE-2017-0141
CVE-2017-0196
CVE-2017-0136
CVE-2017-0152
CVE-2017-0010
CVE-2017-0035
CVE-2017-0015
CVE-2017-0028