Commit d4968875 authored by Paolo Severini's avatar Paolo Severini Committed by Commit Bot

Fixing a possible buffer overrun in win64_unwindinfo::InitUnwindingRecord

The code that copies code bytes from a MacroAssembler into a buffer in a
CodeRangeUnwindingRecord struct (used to store stack unwinding data) has an
error: it copies the whole MacroAssembler buffer size, not just the size of the
compiled instructions into an "exception thunk" array.
This has no real bad effects, because a CodeRangeUnwindingRecord is stored at
the beginning of a page reserved at the beginning of an isolate code range, but
it is quite bad and we need to fix it.

Bug: v8:3598
Change-Id: I0df0cf0173561cc939e6431bc0f01ef040fc189e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1629310Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61863}
parent 6e857421
......@@ -211,8 +211,9 @@ void InitUnwindingRecord(Record* record, size_t code_size_in_bytes) {
NewAssemblerBuffer(64));
masm.movq(rax, reinterpret_cast<uint64_t>(&CRASH_HANDLER_FUNCTION_NAME));
masm.jmp(rax);
DCHECK_GE(masm.buffer_size(), sizeof(record->exception_thunk));
memcpy(&record->exception_thunk[0], masm.buffer_start(), masm.buffer_size());
DCHECK_LE(masm.instruction_size(), sizeof(record->exception_thunk));
memcpy(&record->exception_thunk[0], masm.buffer_start(),
masm.instruction_size());
}
void RegisterNonABICompliantCodeRange(void* start, size_t size_in_bytes) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment