Bug 212460

Created attachment 400443 [details] poc.js Description of problem: The vulnerability was triggered in function fillBufferWithContentsOfFile() at ../../Source/JavaScriptCore/jsc.cpp:948 How reproducible: ./jsc poc.js (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007ffff2465801 in __GI_abort () at abort.c:79 #2 0x00005555555d5f61 in WTF::VectorBufferBase<char, WTF::FastMalloc>::allocateBuffer (newCapacity=<optimized out>, this=0x7fffffb1dc70) at DerivedSources/ForwardingHeaders/wtf/Vector.h:289 #3 WTF::Vector<char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::reserveCapacity (newCapacity=<optimized out>, this=0x7fffffb1dc70) at DerivedSources/ForwardingHeaders/wtf/Vector.h:1190 #4 WTF::Vector<char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::expandCapacity (this=0x7fffffb1dc70, newMinCapacity=<optimized out>) at DerivedSources/ForwardingHeaders/wtf/Vector.h:1048 #5 0x000055555557f8eb in WTF::Vector<char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::resize (size=9223372036854775807, this=0x7fffffb1dc70) at DerivedSources/ForwardingHeaders/wtf/Vector.h:1099 #6 fillBufferWithContentsOfFile<WTF::Vector<char> > (buffer=..., file=0x5555556341f0) at ../../Source/JavaScriptCore/jsc.cpp:948 #7 fillBufferWithContentsOfFile (fileName=..., buffer=...) at ../../Source/JavaScriptCore/jsc.cpp:961 #8 0x00005555555fc785 in fetchScriptFromLocalFileSystem (buffer=..., fileName=...) at ../../Source/JavaScriptCore/jsc.cpp:969 #9 functionRun (globalObject=0x7fffaedfab68, callFrame=0x7fffffb1dd00) at ../../Source/JavaScriptCore/jsc.cpp:1473 The vulnerability was triggered in function fillBufferWithContentsOfFile() at ../../Source/JavaScriptCore/jsc.cpp:948 937 static bool fillBufferWithContentsOfFile(FILE* file, Vector& buffer) 938 { 939 // We might have injected "use strict"; at the top. 940 size_t initialSize = buffer.size(); 941 if (fseek(file, 0, SEEK_END) == -1) 942 return false; 943 long bufferCapacity = ftell(file); 944 if (bufferCapacity == -1) 945 return false; 946 if (fseek(file, 0, SEEK_SET) == -1) 947 return false; 948 buffer.resize(bufferCapacity + initialSize); 949 size_t readSize = fread(buffer.data() + initialSize, 1, buffer.size(), file); 950 return readSize == buffer.size() - initialSize; 951 } Additional info: This vulnerability is detected by chong from OWL337