CVE-2019-0611

Author: MikeHolman

lib/Backend/EmitBuffer.cpp

@@ -414,7 +414,7 @@ bool EmitBufferManager<TAlloc, TPreReservedAlloc, SyncObject>::ProtectBufferWith
 template <typename TAlloc, typename TPreReservedAlloc, class SyncObject>
 bool EmitBufferManager<TAlloc, TPreReservedAlloc, SyncObject>::CommitBufferForInterpreter(TEmitBufferAllocation* allocation, _In_reads_bytes_(bufferSize) BYTE* pBuffer, _In_ size_t bufferSize)
 {
-    Assert(this->criticalSection.IsLocked());
+    AutoRealOrFakeCriticalSection<SyncObject> autoCs(&this->criticalSection);
 
     Assert(allocation != nullptr);
     allocation->bytesUsed += bufferSize;

lib/Backend/ServerScriptContext.cpp

@@ -312,6 +312,7 @@ ServerScriptContext::IsClosed() const
 void
 ServerScriptContext::AddToDOMFastPathHelperMap(intptr_t funcInfoAddr, IR::JnHelperMethod helper)
 {
+    AutoCriticalSection cs(&m_cs);
     m_domFastPathHelperMap->Add(funcInfoAddr, helper);
 }
 
@@ -327,7 +328,7 @@ ServerScriptContext::DecommitEmitBufferManager(bool asmJsManager)
     GetEmitBufferManager(asmJsManager)->Decommit();
 }
 
-OOPEmitBufferManager *
+OOPEmitBufferManagerWithLock *
 ServerScriptContext::GetEmitBufferManager(bool asmJsManager)
 {
     if (asmJsManager)
@@ -343,11 +344,11 @@ ServerScriptContext::GetEmitBufferManager(bool asmJsManager)
 IR::JnHelperMethod
 ServerScriptContext::GetDOMFastPathHelper(intptr_t funcInfoAddr)
 {
+    AutoCriticalSection cs(&m_cs);
+
     IR::JnHelperMethod helper = IR::HelperInvalid;
 
-    m_domFastPathHelperMap->LockResize();
     m_domFastPathHelperMap->TryGetValue(funcInfoAddr, &helper);
-    m_domFastPathHelperMap->UnlockResize();
 
     return helper;
 }
@@ -392,6 +393,7 @@ ServerScriptContext::GetCodeGenAllocators()
 Field(Js::Var)*
 ServerScriptContext::GetModuleExportSlotArrayAddress(uint moduleIndex, uint slotIndex)
 {
+    AutoCriticalSection cs(&m_cs);
     AssertOrFailFast(m_moduleRecords.ContainsKey(moduleIndex));
     auto record = m_moduleRecords.Item(moduleIndex);
     return record->localExportSlotsAddr;
@@ -406,6 +408,7 @@ ServerScriptContext::SetIsPRNGSeeded(bool value)
 void
 ServerScriptContext::AddModuleRecordInfo(unsigned int moduleId, __int64 localExportSlotsAddr)
 {
+    AutoCriticalSection cs(&m_cs);
     Js::ServerSourceTextModuleRecord* record = HeapNewStructZ(Js::ServerSourceTextModuleRecord);
     record->moduleId = moduleId;
     record->localExportSlotsAddr = (Field(Js::Var)*)localExportSlotsAddr;

lib/Backend/ServerScriptContext.h

@@ -80,7 +80,7 @@ class ServerScriptContext : public ScriptContextInfo
     void SetIsPRNGSeeded(bool value);
     void AddModuleRecordInfo(unsigned int moduleId, __int64 localExportSlotsAddr);
     void UpdateGlobalObjectThisAddr(intptr_t globalThis);
-    OOPEmitBufferManager * GetEmitBufferManager(bool asmJsManager);
+    OOPEmitBufferManagerWithLock * GetEmitBufferManager(bool asmJsManager);
     void DecommitEmitBufferManager(bool asmJsManager);
 #ifdef PROFILE_EXEC
     Js::ScriptContextProfiler*  GetCodeGenProfiler(_In_ PageAllocator* pageAllocator);
@@ -100,10 +100,11 @@ class ServerScriptContext : public ScriptContextInfo
     Js::ScriptContextProfiler * codeGenProfiler;
     CriticalSection profilerCS;
 #endif
+    CriticalSection m_cs;
     ArenaAllocator m_sourceCodeArena;
 
-    OOPEmitBufferManager m_interpreterThunkBufferManager;
-    OOPEmitBufferManager m_asmJsInterpreterThunkBufferManager;
+    OOPEmitBufferManagerWithLock m_interpreterThunkBufferManager;
+    OOPEmitBufferManagerWithLock m_asmJsInterpreterThunkBufferManager;
 
     ScriptContextDataIDL m_contextData;
     intptr_t m_globalThisAddr;

lib/JITIDL/ChakraJIT.acf

@@ -3,13 +3,26 @@
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
 
-typedef [context_handle_noserialize] PTHREADCONTEXT_HANDLE;
-typedef [context_handle_noserialize] PSCRIPTCONTEXT_HANDLE;
-
 [
     type_strict_context_handle
 ]
 interface IChakraJIT
 {
+    UpdatePropertyRecordMap([context_handle_noserialize] threadContextInfoAddress);
+    AddDOMFastPathHelper([context_handle_noserialize] scriptContextInfoAddress);
+    AddModuleRecordInfo([context_handle_noserialize] scriptContextInfoAddress);
+    SetWellKnownHostTypeId([context_handle_noserialize] threadContextInfoAddress);
+    CloseScriptContext([context_handle_noserialize] scriptContextInfoAddress);
+    FreeAllocation([context_handle_noserialize] scriptContextInfoAddress);
+    NewInterpreterThunkBlock([context_handle_noserialize] scriptContextInfoAddress);
+    DecommitInterpreterBufferManager([context_handle_noserialize] scriptContextInfoAddress);
+    IsNativeAddr([context_handle_noserialize] threadContextInfoAddress);
+    SetIsPRNGSeeded([context_handle_noserialize] scriptContextInfoAddress);
+    RemoteCodeGen([context_handle_noserialize] scriptContextInfoAddress);
+
+#if DBG
+    IsInterpreterThunkAddr([context_handle_noserialize] scriptContextInfoAddress);
+#endif
+
     typedef [encode, decode] pCodeGenWorkItemIDL;
 }

lib/JITServer/JITServer.cpp

@@ -502,7 +502,7 @@ ServerNewInterpreterThunkBlock(
             ServerThreadContext * threadContext;
         } localAlloc(threadContext);
 
-        OOPEmitBufferManager * emitBufferManager = scriptContext->GetEmitBufferManager(thunkInput->asmJsThunk != FALSE);
+        OOPEmitBufferManagerWithLock * emitBufferManager = scriptContext->GetEmitBufferManager(thunkInput->asmJsThunk != FALSE);
 
         BYTE* runtimeAddress;
         EmitBufferAllocation<SectionAllocWrapper, PreReservedSectionAllocWrapper> * alloc = emitBufferManager->AllocateBuffer(InterpreterThunkEmitter::BlockSize, &runtimeAddress);
@@ -573,7 +573,7 @@ ServerIsInterpreterThunkAddr(
         *result = false;
         return RPC_S_INVALID_ARG;
     }
-    OOPEmitBufferManager * manager = context->GetEmitBufferManager(asmjsThunk != FALSE);
+    OOPEmitBufferManagerWithLock * manager = context->GetEmitBufferManager(asmjsThunk != FALSE);
     if (manager == nullptr)
     {
         *result = false;