Skip to content

Commit 720e9a9

Browse files
pthiermibrunin
pthier
authored and
mibrunin
committed
[Backport] CVE-2025-12432: Race in V8
Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/7077055: Parser: Early return if Expect() fails Expect()/ExpectNext() used to simply set the cursor to the end of the input if the expectation failed. The issue is that a failed expectation can trigger a GC due to allocation of the Exception object. To avoid surprises, Expect() and ExpectNext() now return a bool value indicating if the expectation failed. Checking of this value is enforced and all current usages are replaced by a Macro that returns early if an exception was thrown. Drive-by: Also force checking the return value of Check(). (cherry picked from commit 50eba5e6c269c71d6e0e758b84fafe8d5c37d210) Fixed: 452296415 Change-Id: I513955f1ea0eb44cd0a59eb2aa57caee8f3082fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7048404 Reviewed-by: Igor Sheludko <[email protected]> Commit-Queue: Patrick Thier <[email protected]> Cr-Original-Commit-Position: refs/heads/main@{#103167} Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7077055 Commit-Queue: Gyuyoung Kim (xWF) <[email protected]> Reviewed-by: Patrick Thier <[email protected]> Cr-Commit-Position: refs/branch-heads/13.8@{#76} Cr-Branched-From: 61ddd471ece346840bbebbb308dceb4b4ce31b28-refs/heads/13.8.258@{#1} Cr-Branched-From: fdb5de2c741658e94944f2ec1218530e98601c23-refs/heads/main@{#100480} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/689572 Reviewed-by: Michal Klocek <[email protected]>
1 parent d92dcbb commit 720e9a9

File tree

2 files changed

+49
-29
lines changed

2 files changed

+49
-29
lines changed

‎chromium/v8/src/json/json-parser.cc‎

Lines changed: 37 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,15 @@ static const constexpr uint8_t character_json_scan_flags[256] = {
128128
#undef CALL_GET_SCAN_FLAGS
129129
};
130130

131+
#define EXPECT_RETURN_ON_ERROR(token, msg, ret) \
132+
if (V8_UNLIKELY(!Expect(token, msg))) { \
133+
return ret; \
134+
}
135+
#define EXPECT_NEXT_RETURN_ON_ERROR(token, msg, ret) \
136+
if (V8_UNLIKELY(!ExpectNext(token, msg))) { \
137+
return ret; \
138+
}
139+
131140
} // namespace
132141

133142
MaybeHandle<Object> JsonParseInternalizer::Internalize(
@@ -1493,20 +1502,22 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonObject(Handle<Map> feedback) {
14931502
property_stack_.size());
14941503
bool first = true;
14951504
do {
1496-
ExpectNext(
1505+
EXPECT_NEXT_RETURN_ON_ERROR(
14971506
JsonToken::STRING,
14981507
first ? MessageTemplate::kJsonParseExpectedPropNameOrRBrace
1499-
: MessageTemplate::kJsonParseExpectedDoubleQuotedPropertyName);
1508+
: MessageTemplate::kJsonParseExpectedDoubleQuotedPropertyName,
1509+
{});
15001510
JsonString key = ScanJsonPropertyKey(&cont);
1501-
ExpectNext(JsonToken::COLON,
1502-
MessageTemplate::kJsonParseExpectedColonAfterPropertyName);
1511+
EXPECT_NEXT_RETURN_ON_ERROR(JsonToken::COLON,
1512+
MessageTemplate::kJsonParseExpectedColonAfterPropertyName, {});
15031513
Handle<Object> value;
15041514
if (V8_UNLIKELY(!ParseJsonValueRecursive().ToHandle(&value))) return {};
15051515
property_stack_.emplace_back(key, value);
15061516
first = false;
15071517
} while (Check(JsonToken::COMMA));
15081518

1509-
Expect(JsonToken::RBRACE, MessageTemplate::kJsonParseExpectedCommaOrRBrace);
1519+
EXPECT_RETURN_ON_ERROR(JsonToken::RBRACE,
1520+
MessageTemplate::kJsonParseExpectedCommaOrRBrace, {});
15101521
Handle<Object> result = BuildJsonObject<false>(cont, feedback);
15111522
property_stack_.resize_no_init(cont.index);
15121523
return cont.scope.CloseAndEscape(result);
@@ -1552,8 +1563,8 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonArray() {
15521563
SkipWhitespace();
15531564
continue;
15541565
} else {
1555-
Expect(JsonToken::RBRACK,
1556-
MessageTemplate::kJsonParseExpectedCommaOrRBrack);
1566+
EXPECT_RETURN_ON_ERROR(JsonToken::RBRACK,
1567+
MessageTemplate::kJsonParseExpectedCommaOrRBrack, {});
15571568
success = true;
15581569
break;
15591570
}
@@ -1621,7 +1632,7 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonArray() {
16211632
element_stack_.emplace_back(value);
16221633
}
16231634

1624-
Expect(JsonToken::RBRACK, MessageTemplate::kJsonParseExpectedCommaOrRBrack);
1635+
EXPECT_RETURN_ON_ERROR(JsonToken::RBRACK, MessageTemplate::kJsonParseExpectedCommaOrRBrack, {});
16251636
Handle<Object> result = BuildJsonArray(start);
16261637
element_stack_.resize_no_init(start);
16271638
return handle_scope.CloseAndEscape(result);
@@ -1731,15 +1742,19 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonValue() {
17311742
property_stack_.size());
17321743

17331744
// Parse the property key.
1734-
ExpectNext(JsonToken::STRING,
1735-
MessageTemplate::kJsonParseExpectedPropNameOrRBrace);
1745+
EXPECT_NEXT_RETURN_ON_ERROR(
1746+
JsonToken::STRING,
1747+
MessageTemplate::kJsonParseExpectedPropNameOrRBrace,
1748+
{});
17361749
property_stack_.emplace_back(ScanJsonPropertyKey(&cont));
17371750
if constexpr (should_track_json_source) {
17381751
property_val_node_stack.emplace_back(Handle<Object>());
17391752
}
17401753

1741-
ExpectNext(JsonToken::COLON,
1742-
MessageTemplate::kJsonParseExpectedColonAfterPropertyName);
1754+
EXPECT_NEXT_RETURN_ON_ERROR(
1755+
JsonToken::COLON,
1756+
MessageTemplate::kJsonParseExpectedColonAfterPropertyName,
1757+
{});
17431758

17441759
// Continue to start producing the first property value.
17451760
continue;
@@ -1835,17 +1850,19 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonValue() {
18351850

18361851
if (V8_LIKELY(Check(JsonToken::COMMA))) {
18371852
// Parse the property key.
1838-
ExpectNext(
1853+
EXPECT_NEXT_RETURN_ON_ERROR(
18391854
JsonToken::STRING,
1840-
MessageTemplate::kJsonParseExpectedDoubleQuotedPropertyName);
1855+
MessageTemplate::kJsonParseExpectedDoubleQuotedPropertyName,
1856+
{});
18411857

18421858
property_stack_.emplace_back(ScanJsonPropertyKey(&cont));
18431859
if constexpr (should_track_json_source) {
18441860
property_val_node_stack.emplace_back(Handle<Object>());
18451861
}
1846-
ExpectNext(
1862+
EXPECT_NEXT_RETURN_ON_ERROR(
18471863
JsonToken::COLON,
1848-
MessageTemplate::kJsonParseExpectedColonAfterPropertyName);
1864+
MessageTemplate::kJsonParseExpectedColonAfterPropertyName,
1865+
{});
18491866

18501867
// Break to start producing the subsequent property value.
18511868
break;
@@ -1865,8 +1882,8 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonValue() {
18651882
}
18661883
}
18671884
value = BuildJsonObject<should_track_json_source>(cont, feedback);
1868-
Expect(JsonToken::RBRACE,
1869-
MessageTemplate::kJsonParseExpectedCommaOrRBrace);
1885+
EXPECT_NEXT_RETURN_ON_ERROR(JsonToken::RBRACE,
1886+
MessageTemplate::kJsonParseExpectedCommaOrRBrace, {});
18701887
// Return the object.
18711888
if constexpr (should_track_json_source) {
18721889
size_t start = cont.index;
@@ -1916,8 +1933,8 @@ MaybeHandle<Object> JsonParser<Char>::ParseJsonValue() {
19161933
if (V8_LIKELY(Check(JsonToken::COMMA))) break;
19171934

19181935
value = BuildJsonArray(cont.index);
1919-
Expect(JsonToken::RBRACK,
1920-
MessageTemplate::kJsonParseExpectedCommaOrRBrack);
1936+
EXPECT_RETURN_ON_ERROR(JsonToken::RBRACK,
1937+
MessageTemplate::kJsonParseExpectedCommaOrRBrack, {});
19211938
// Return the array.
19221939
if constexpr (should_track_json_source) {
19231940
size_t start = cont.index;

‎chromium/v8/src/json/json-parser.h‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -238,23 +238,26 @@ class JsonParser final {
238238
advance();
239239
}
240240

241-
void Expect(JsonToken token,
242-
std::optional<MessageTemplate> errorMessage = std::nullopt) {
241+
V8_WARN_UNUSED_RESULT bool Expect(
242+
JsonToken token,
243+
std::optional<MessageTemplate> errorMessage = std::nullopt) {
243244
if (V8_LIKELY(peek() == token)) {
244245
advance();
245-
} else {
246-
errorMessage ? ReportUnexpectedToken(peek(), errorMessage.value())
247-
: ReportUnexpectedToken(peek());
246+
return true;
248247
}
248+
errorMessage ? ReportUnexpectedToken(peek(), errorMessage.value())
249+
: ReportUnexpectedToken(peek());
250+
return false;
249251
}
250252

251-
void ExpectNext(JsonToken token,
252-
std::optional<MessageTemplate> errorMessage = std::nullopt) {
253+
V8_WARN_UNUSED_RESULT bool ExpectNext(
254+
JsonToken token,
255+
std::optional<MessageTemplate> errorMessage = std::nullopt) {
253256
SkipWhitespace();
254-
errorMessage ? Expect(token, errorMessage.value()) : Expect(token);
257+
return errorMessage ? Expect(token, errorMessage.value()) : Expect(token);
255258
}
256259

257-
bool Check(JsonToken token) {
260+
V8_WARN_UNUSED_RESULT bool Check(JsonToken token) {
258261
SkipWhitespace();
259262
if (next_ != token) return false;
260263
advance();

0 commit comments

Comments
 (0)