LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-14 01:04:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibJS: Don't mark blocks for unification multiple times

Browse Source 
This would cause a UAF otherwise
This commit is contained in:
Hendiadyoin1 2022-11-02 14:28:47 +01:00 committed by Ali Mohammad Pur
parent 35db0c5e18
commit 7697e09660
Notes: sideshowbarker 2024-07-18 00:41:35 +09:00 
Author: https://github.com/Hendiadyoin1
Commit: https://github.com/SerenityOS/serenity/commit/7697e09660
Pull-request: https://github.com/SerenityOS/serenity/pull/15971
Reviewed-by: https://github.com/FireFox317
Reviewed-by: https://github.com/alimpfard
Reviewed-by: https://github.com/kleinesfilmroellchen ✅
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Userland/Libraries/LibJS/Bytecode/Pass/UnifySameBlocks.cpp
View File

@ -24,6 +24,8 @@ void UnifySameBlocks::perform(PassPipelineExecutable& executable)
auto& block = executable.executable.basic_blocks[i];
auto block_bytes = block.instruction_stream();
for (auto& candidate_block : executable.executable.basic_blocks.span().slice(i + 1)) {
if (equal_blocks.contains(&*candidate_block))
continue;
// FIXME: This can probably be relaxed a bit...
if (candidate_block->size() != block.size())
continue;