[CVE-2017-11912] Regex construction can depend on unintialized memory…

… and leak stack contents
chakra-core · Dec 7, 2017 · 1e7fa7b · 1e7fa7b
1 parent 40232a4
commit 1e7fa7b
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 5 deletions.
diff --git a/lib/Parser/RegexCompileTime.cpp b/lib/Parser/RegexCompileTime.cpp
@@ -1173,7 +1173,17 @@ namespace UnifiedRegex
     {
         if ((compiler.program->flags & IgnoreCaseRegexFlag) != 0)
         {
-            Char equivs[CaseInsensitive::EquivClassSize];
+            // To ensure initialization, we first default-initialize the
+            // whole array with a constant, and then individually set it
+            // to be just the first character (known to exist). This can
+            // hopefully be optimized to just initialize to cs[0] by the
+            // compiler.
+            Char equivs[CaseInsensitive::EquivClassSize] = { (Char)-1 };
+            for (int i = 0; i < CaseInsensitive::EquivClassSize; i++)
+            {
+                equivs[i] = cs[0];
+
+            }
             bool isNonTrivial = compiler.standardChars->ToEquivs(compiler.program->GetCaseMappingSource(), cs[0], equivs);
             if (isNonTrivial)
             {
@@ -1279,10 +1289,23 @@ namespace UnifiedRegex
     {
         if (isEquivClass)
         {
-            Char uniqueEquivs[CaseInsensitive::EquivClassSize];
+            // To ensure initialization, we first default-initialize the
+            // whole array with a constant, and then individually set it
+            // to be just the first character (known to exist). This can
+            // hopefully be optimized to just initialize to cs[0] by the
+            // compiler.
+            Char uniqueEquivs[CaseInsensitive::EquivClassSize] = { (Char)-1 };
+            for (int i = 0; i < CaseInsensitive::EquivClassSize; i++)
+            {
+                uniqueEquivs[i] = cs[0];
+            }
             CharCount uniqueEquivCount = FindUniqueEquivs(cs, uniqueEquivs);
             switch (uniqueEquivCount)
             {
+            case 1:
+                EMIT(compiler, MatchCharInst, uniqueEquivs[0]);
+                break;
+
             case 2:
                 EMIT(compiler, MatchChar2Inst, uniqueEquivs[0], uniqueEquivs[1]);
                 break;

diff --git a/lib/Parser/RegexCompileTime.h b/lib/Parser/RegexCompileTime.h
@@ -374,10 +374,8 @@ namespace UnifiedRegex
             , isEquivClass(false)
         {
             cs[0] = c;
-#if DBG
             for (int i = 1; i < CaseInsensitive::EquivClassSize; i++)
-                cs[i] = (Char)-1;
-#endif
+                cs[i] = c;
         }
 
         NODE_DECL