1234567891011121314151617181920212223 |
- From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
- From: Andrey Belenko <[email protected]>
- Date: Thu, 10 Dec 2020 22:09:07 +0100
- Subject: Chromium backport: crbug.com/1151890
- M87-1
- Fix possibly-uninitialized leading digit on right shift
- https://chromium-review.googlesource.com/c/v8/v8/+/2565245
- CVE-2020-16042
- diff --git a/src/objects/bigint.cc b/src/objects/bigint.cc
- index dfc302e77c894519d647e005e02d74764d6b6b6a..3a9e169757526dd65161f50c10ca1d4bdea62767 100644
- --- a/src/objects/bigint.cc
- +++ b/src/objects/bigint.cc
- @@ -1862,6 +1862,8 @@ Handle<BigInt> MutableBigInt::RightShiftByAbsolute(Isolate* isolate,
- DCHECK_LE(result_length, length);
- Handle<MutableBigInt> result = New(isolate, result_length).ToHandleChecked();
- if (bits_shift == 0) {
- + // Zero out any overflow digit (see "rounding_can_overflow" above).
- + result->set_digit(result_length - 1, 0);
- for (int i = digit_shift; i < length; i++) {
- result->set_digit(i - digit_shift, x->digit(i));
- }
|