• Patrick Thier's avatar
    [regexp] Secure interpreter dispatch. · 67a70d7e
    Patrick Thier authored
    Currently the dispatch table could be accessed out of bounds if something
    is wrong with the generated bytecode.
    OOB access of the dispatch table can lead to jumps to arbitrary addresses
    in the code space.
    
    This CL prevents this issue by changing the following:
    BYTECODE_MASK now filters out all bits not currently used for bytecodes.
    All unused slots between the last actually defined bytecode and
    BYTECODE_MASK are now filled with BREAK Bytecodes (invalid operation).
    This way we can not access out of bounds of the dispatch table if
    something is broken/tampered with, preventing jumps to arbitrary code.
    
    Bug: v8:9699
    Change-Id: Ibce591ae94b52472ba74a9fd0666e55185af7b2c
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795349
    Commit-Queue: Patrick Thier <pthier@google.com>
    Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
    Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#63708}
    67a70d7e
Name
Last commit
Last update
..
api Loading commit data...
asmjs Loading commit data...
ast Loading commit data...
base Loading commit data...
builtins Loading commit data...
codegen Loading commit data...
common Loading commit data...
compiler Loading commit data...
compiler-dispatcher Loading commit data...
d8 Loading commit data...
date Loading commit data...
debug Loading commit data...
deoptimizer Loading commit data...
diagnostics Loading commit data...
execution Loading commit data...
extensions Loading commit data...
flags Loading commit data...
handles Loading commit data...
heap Loading commit data...
ic Loading commit data...
init Loading commit data...
inspector Loading commit data...
interpreter Loading commit data...
json Loading commit data...
libplatform Loading commit data...
libsampler Loading commit data...
logging Loading commit data...
numbers Loading commit data...
objects Loading commit data...
parsing Loading commit data...
profiler Loading commit data...
protobuf Loading commit data...
regexp Loading commit data...
roots Loading commit data...
runtime Loading commit data...
sanitizer Loading commit data...
snapshot Loading commit data...
strings Loading commit data...
tasks Loading commit data...
third_party Loading commit data...
torque Loading commit data...
tracing Loading commit data...
trap-handler Loading commit data...
utils Loading commit data...
wasm Loading commit data...
zone Loading commit data...
DEPS Loading commit data...
OWNERS Loading commit data...