-
Patrick Thier authored
Currently the dispatch table could be accessed out of bounds if something is wrong with the generated bytecode. OOB access of the dispatch table can lead to jumps to arbitrary addresses in the code space. This CL prevents this issue by changing the following: BYTECODE_MASK now filters out all bits not currently used for bytecodes. All unused slots between the last actually defined bytecode and BYTECODE_MASK are now filled with BREAK Bytecodes (invalid operation). This way we can not access out of bounds of the dispatch table if something is broken/tampered with, preventing jumps to arbitrary code. Bug: v8:9699 Change-Id: Ibce591ae94b52472ba74a9fd0666e55185af7b2c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795349 Commit-Queue: Patrick Thier <pthier@google.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#63708}
67a70d7e