Home Explore 引导页 在线工具 Blog
Register Sign In
Pchen0
/
electron
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: 9-x-y
Branches Tags
electron
/
patches
/
pdfium
/
backport_1091404.patch

backport_1091404.patch 2.7 KB
Permalink History Raw

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879 
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
    2. 

  2. From: Cheng Zhao <[email protected]>
    3. 

  3. Date: Wed, 23 Oct 2019 12:54:32 -0700
    4. 

  4. Subject: fix: make PDFium JS host object have immutable prototypes
    5. 

  5. 

  6. [1091404] [High] [CVE-2020-6513]: Google Chrome PDFium Javascript Active Document Memory Corruption Vulnerability - TALOS-2020-1092
    7. 

  7. Backport https://pdfium.googlesource.com/pdfium.git/+/bee2261eab794536f236013fa8c9d01728ed326b.
    8. 

  8. 

  9. diff --git a/fxjs/cfxjs_engine.cpp b/fxjs/cfxjs_engine.cpp
    10. 

  10. index 9624feb2dc91b03f9eb32bab772f235b682cf9a1..4a15ebe11ed7a82ded11ca0de031b8818811143b 100644
    11. 

  11. --- a/fxjs/cfxjs_engine.cpp
    12. 

  12. +++ b/fxjs/cfxjs_engine.cpp
    13. 

  13. @@ -145,6 +145,7 @@ class CFXJS_ObjDefinition {
    14. 

  14.      v8::HandleScope handle_scope(isolate);
    15. 

  15.      v8::Local<v8::FunctionTemplate> fn = v8::FunctionTemplate::New(isolate);
    16. 

  16.      fn->InstanceTemplate()->SetInternalFieldCount(2);
    17. 

  17. +    fn->InstanceTemplate()->SetImmutableProto();
    18. 

  18.      fn->SetCallHandler(CallHandler, v8::Number::New(isolate, eObjType));
    19. 

  19.      if (eObjType == FXJSOBJTYPE_GLOBAL) {
    20. 

  20.        fn->InstanceTemplate()->Set(v8::Symbol::GetToStringTag(isolate),
    21. 

  21. diff --git a/testing/resources/javascript/immutable_proto.in b/testing/resources/javascript/immutable_proto.in
    22. 

  22. new file mode 100644
    23. 

  23. index 0000000000000000000000000000000000000000..61885c53758167cae5af47f8736014dcb0933aaf
    24. 

  24. --- /dev/null
    25. 

  25. +++ b/testing/resources/javascript/immutable_proto.in
    26. 

  26. @@ -0,0 +1,43 @@
    27. 

  27. +{{header}}
    28. 

  28. +{{object 1 0}} <<
    29. 

  29. +  /Type /Catalog
    30. 

  30. +  /Pages 2 0 R
    31. 

  31. +  /OpenAction 10 0 R
    32. 

  32. +>>
    33. 

  33. +endobj
    34. 

  34. +{{object 2 0}} <<
    35. 

  35. +  /Type /Pages
    36. 

  36. +  /Count 1
    37. 

  37. +  /Kids [
    38. 

  38. +    3 0 R
    39. 

  39. +  ]
    40. 

  40. +>>
    41. 

  41. +endobj
    42. 

  42. +{{object 3 0}} <<
    43. 

  43. +  /Type /Page
    44. 

  44. +  /Parent 2 0 R
    45. 

  45. +  /MediaBox [0 0 612 792]
    46. 

  46. +>>
    47. 

  47. +endobj
    48. 

  48. +% OpenAction action
    49. 

  49. +{{object 10 0}} <<
    50. 

  50. +  /Type /Action
    51. 

  51. +  /S /JavaScript
    52. 

  52. +  /JS 11 0 R
    53. 

  53. +>>
    54. 

  54. +endobj
    55. 

  55. +{{object 11 0}} <<
    56. 

  56. +  {{streamlen}}
    57. 

  57. +>>
    58. 

  58. +stream
    59. 

  59. +{{include expect.js}}
    60. 

  60. +expect("this.__proto__", "[object Object]");
    61. 

  61. +expect("app.__proto__", "[object Object]");
    62. 

  62. +expectError("this.__proto__ = {}");
    63. 

  63. +expectError("app.__proto__ = this");
    64. 

  64. +endstream
    65. 

  65. +endobj
    66. 

  66. +{{xref}}
    67. 

  67. +{{trailer}}
    68. 

  68. +{{startxref}}
    69. 

  69. +%%EOF
    70. 

  70. diff --git a/testing/resources/javascript/immutable_proto_expected.txt b/testing/resources/javascript/immutable_proto_expected.txt
    71. 

  71. new file mode 100644
    72. 

  72. index 0000000000000000000000000000000000000000..7e7c6701e39592ec130ae52fc98f8af903b3152b
    73. 

  73. --- /dev/null
    74. 

  74. +++ b/testing/resources/javascript/immutable_proto_expected.txt
    75. 

  75. @@ -0,0 +1,4 @@
    76. 

  76. +Alert: PASS: this.__proto__ = [object Object]
    77. 

  77. +Alert: PASS: app.__proto__ = [object Object]
    78. 

  78. +Alert: PASS: this.__proto__ = {} threw TypeError: Immutable prototype object '[object global]' cannot have their prototype set
    79. 

  79. +Alert: PASS: app.__proto__ = this threw TypeError: Immutable prototype object '[object Object]' cannot have their prototype set
    80.