backport_1151890.patch 1016 B

1234567891011121314151617181920212223
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
  2. From: Andrey Belenko <[email protected]>
  3. Date: Thu, 10 Dec 2020 22:09:07 +0100
  4. Subject: Chromium backport: crbug.com/1151890
  5. M87-1
  6. Fix possibly-uninitialized leading digit on right shift
  7. https://chromium-review.googlesource.com/c/v8/v8/+/2565245
  8. CVE-2020-16042
  9. diff --git a/src/objects/bigint.cc b/src/objects/bigint.cc
  10. index dfc302e77c894519d647e005e02d74764d6b6b6a..3a9e169757526dd65161f50c10ca1d4bdea62767 100644
  11. --- a/src/objects/bigint.cc
  12. +++ b/src/objects/bigint.cc
  13. @@ -1862,6 +1862,8 @@ Handle<BigInt> MutableBigInt::RightShiftByAbsolute(Isolate* isolate,
  14. DCHECK_LE(result_length, length);
  15. Handle<MutableBigInt> result = New(isolate, result_length).ToHandleChecked();
  16. if (bits_shift == 0) {
  17. + // Zero out any overflow digit (see "rounding_can_overflow" above).
  18. + result->set_digit(result_length - 1, 0);
  19. for (int i = digit_shift; i < length; i++) {
  20. result->set_digit(i - digit_shift, x->digit(i));
  21. }