Wed Oct 3 18:58:23 2018 UTC ()
spidermonkey52: backport patch for CVE-2018-12387

Don't inline push with more than 1 argument

A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process.

Bump PKGREVISION


(maya)
diff -r1.9 -r1.10 pkgsrc/lang/spidermonkey52/Makefile
diff -r1.4 -r1.5 pkgsrc/lang/spidermonkey52/distinfo
diff -r0 -r1.1 pkgsrc/lang/spidermonkey52/patches/patch-CVE-2018-12387
cvs diff -r1.9 -r1.10 pkgsrc/lang/spidermonkey52/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/lang/spidermonkey52/Attic/Makefile 2018/08/22 09:45:22 1.9
+++ pkgsrc/lang/spidermonkey52/Attic/Makefile 2018/10/03 18:58:22 1.10
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.9 2018/08/22 09:45:22 wiz Exp $ 1# $NetBSD: Makefile,v 1.10 2018/10/03 18:58:22 maya Exp $
2 2
3DISTNAME= mozjs-52.7.4 3DISTNAME= mozjs-52.7.4
4PKGREVISION= 4 4PKGREVISION= 5
5PKGNAME= ${DISTNAME:S/mozjs/spidermonkey52/} 5PKGNAME= ${DISTNAME:S/mozjs/spidermonkey52/}
6CATEGORIES= lang 6CATEGORIES= lang
7MASTER_SITES= https://queue.taskcluster.net/v1/task/YqG2fjJJSTGzGX090FjDYg/runs/0/artifacts/public/build/ 7MASTER_SITES= https://queue.taskcluster.net/v1/task/YqG2fjJJSTGzGX090FjDYg/runs/0/artifacts/public/build/
8EXTRACT_SUFX= .tar.bz2 8EXTRACT_SUFX= .tar.bz2
9 9
10MAINTAINER= pkgsrc-users@NetBSD.org 10MAINTAINER= pkgsrc-users@NetBSD.org
11HOMEPAGE= https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey/Releases/52 11HOMEPAGE= https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey/Releases/52
12COMMENT= Standalone JavaScript implementation in C (major version 52) 12COMMENT= Standalone JavaScript implementation in C (major version 52)
13LICENSE= mpl-2.0 13LICENSE= mpl-2.0
14 14
15HAS_CONFIGURE= yes 15HAS_CONFIGURE= yes
16USE_LANGUAGES= c c++ 16USE_LANGUAGES= c c++
17USE_TOOLS+= pkg-config perl gmake autoconf213 17USE_TOOLS+= pkg-config perl gmake autoconf213
cvs diff -r1.4 -r1.5 pkgsrc/lang/spidermonkey52/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/spidermonkey52/Attic/distinfo 2018/05/19 12:38:28 1.4
+++ pkgsrc/lang/spidermonkey52/Attic/distinfo 2018/10/03 18:58:22 1.5
@@ -1,19 +1,20 @@ @@ -1,19 +1,20 @@
1$NetBSD: distinfo,v 1.4 2018/05/19 12:38:28 youri Exp $ 1$NetBSD: distinfo,v 1.5 2018/10/03 18:58:22 maya Exp $
2 2
3SHA1 (mozjs-52.7.4.tar.bz2) = ff009853040bb46017204fda4ed69a79484fd321 3SHA1 (mozjs-52.7.4.tar.bz2) = ff009853040bb46017204fda4ed69a79484fd321
4RMD160 (mozjs-52.7.4.tar.bz2) = 71ee71c2444d8b6a1b2b3c744c9f52a2b7129879 4RMD160 (mozjs-52.7.4.tar.bz2) = 71ee71c2444d8b6a1b2b3c744c9f52a2b7129879
5SHA512 (mozjs-52.7.4.tar.bz2) = 7381f251ca9a4983d181eee2198f89b30505a0de636020e52c0c5b174f4d5cd19ca851222b6d8013bb657f2f1ce1ffcb54816eb928e481be2c9242f918d0125e 5SHA512 (mozjs-52.7.4.tar.bz2) = 7381f251ca9a4983d181eee2198f89b30505a0de636020e52c0c5b174f4d5cd19ca851222b6d8013bb657f2f1ce1ffcb54816eb928e481be2c9242f918d0125e
6Size (mozjs-52.7.4.tar.bz2) = 30494311 bytes 6Size (mozjs-52.7.4.tar.bz2) = 30494311 bytes
 7SHA1 (patch-CVE-2018-12387) = a0e3198e1009db01bb5a39220764e7dcdfd52591
7SHA1 (patch-build_moz.configure_init.configure) = 63ed71d4269e8fbf990f44eecadca796991d5c1f 8SHA1 (patch-build_moz.configure_init.configure) = 63ed71d4269e8fbf990f44eecadca796991d5c1f
8SHA1 (patch-config_gcc__hidden.h) = c2042035288e01601b6c240fb08c8a1f598b9dfd 9SHA1 (patch-config_gcc__hidden.h) = c2042035288e01601b6c240fb08c8a1f598b9dfd
9SHA1 (patch-intl_icu_source_configure) = 1ff1be8ca68566e153219e15b8db696afd08b746 10SHA1 (patch-intl_icu_source_configure) = 1ff1be8ca68566e153219e15b8db696afd08b746
10SHA1 (patch-js_src_gc_Memory.cpp) = b1bb0c3045163d586c0b4d731d0ed7c23f339f3c 11SHA1 (patch-js_src_gc_Memory.cpp) = b1bb0c3045163d586c0b4d731d0ed7c23f339f3c
11SHA1 (patch-js_src_jsnativestack.cpp) = 3d0b06ccc3e24b408b97d01faa7758353f2edc85 12SHA1 (patch-js_src_jsnativestack.cpp) = 3d0b06ccc3e24b408b97d01faa7758353f2edc85
12SHA1 (patch-js_src_old-configure_in) = 707cdb8a8ff9abaa7017be10bd2c5727d05b605b 13SHA1 (patch-js_src_old-configure_in) = 707cdb8a8ff9abaa7017be10bd2c5727d05b605b
13SHA1 (patch-js_src_tests_update-test262.sh) = 10d73d95f4b849090bccb8fe656df79cbcea89f3 14SHA1 (patch-js_src_tests_update-test262.sh) = 10d73d95f4b849090bccb8fe656df79cbcea89f3
14SHA1 (patch-js_src_threading_posix_Thread.cpp) = e490d04ed28ffd8b2e9901a24739ad19fe6759e0 15SHA1 (patch-js_src_threading_posix_Thread.cpp) = e490d04ed28ffd8b2e9901a24739ad19fe6759e0
15SHA1 (patch-js_src_wasm_WasmSignalHandlers.cpp) = fd9b836d35d71103c3d8b628a6fe7c446bd4c7da 16SHA1 (patch-js_src_wasm_WasmSignalHandlers.cpp) = fd9b836d35d71103c3d8b628a6fe7c446bd4c7da
16SHA1 (patch-memory_mozalloc_mozalloc__abort.cpp) = 610f7457f6a1993d26fcccd5730113bb48926d99 17SHA1 (patch-memory_mozalloc_mozalloc__abort.cpp) = 610f7457f6a1993d26fcccd5730113bb48926d99
17SHA1 (patch-mfbt_Poison.cpp) = f4560e4552beeb70d0564e3fdfd908c5e0bd94c4 18SHA1 (patch-mfbt_Poison.cpp) = f4560e4552beeb70d0564e3fdfd908c5e0bd94c4
18SHA1 (patch-mfbt_tests_TestPoisonArea.cpp) = 054441d4618bf630be6d6e71babdcdaa884f533a 19SHA1 (patch-mfbt_tests_TestPoisonArea.cpp) = 054441d4618bf630be6d6e71babdcdaa884f533a
19SHA1 (patch-modules_fdlibm_src_math__private.h) = afa40802bfdb917d7906de486eb8882da426c9cf 20SHA1 (patch-modules_fdlibm_src_math__private.h) = afa40802bfdb917d7906de486eb8882da426c9cf
File Added: pkgsrc/lang/spidermonkey52/patches/Attic/patch-CVE-2018-12387
$NetBSD: patch-CVE-2018-12387,v 1.1 2018/10/03 18:58:22 maya Exp $

From 64de926d460164d41269812742a1376ba7bafda6 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Tue, 25 Sep 2018 12:33:42 +0200
Subject: [PATCH] Bug 1493903 - Don't inline push with more than 1 argument.
 r=tcampbell

CVE-2018-12387

--- js/src/jit/MCallOptimize.cpp.orig	2018-04-28 01:04:03.000000000 +0000
+++ js/src/jit/MCallOptimize.cpp
@@ -818,6 +818,12 @@ IonBuilder::inlineArraySlice(CallInfo& c
         return InliningStatus_NotInlined;
     }
 
+    // XXX bug 1493903.
+    if (callInfo.argc() != 1) {
+        trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
+        return InliningStatus_NotInlined;
+    }
+
     MDefinition* obj = convertUnboxedObjects(callInfo.thisArg());
 
     // Ensure |this| and result are objects.