8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property
Reviewed-by: attila, jlaskey
--- a/nashorn/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/objects/AccessorPropertyDescriptor.java Tue Feb 25 18:56:10 2014 +0530
@@ -185,6 +185,18 @@
}
@Override
+ public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+ if (! (otherDesc instanceof AccessorPropertyDescriptor)) {
+ return false;
+ }
+ final AccessorPropertyDescriptor other = (AccessorPropertyDescriptor)otherDesc;
+ return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+ (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+ (!has(GET) || sameValue(get, other.get)) &&
+ (!has(SET) || sameValue(set, other.set));
+ }
+
+ @Override
public boolean equals(final Object obj) {
if (this == obj) {
return true;
--- a/nashorn/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/objects/DataPropertyDescriptor.java Tue Feb 25 18:56:10 2014 +0530
@@ -172,6 +172,19 @@
}
@Override
+ public boolean hasAndEquals(final PropertyDescriptor otherDesc) {
+ if (! (otherDesc instanceof DataPropertyDescriptor)) {
+ return false;
+ }
+
+ final DataPropertyDescriptor other = (DataPropertyDescriptor)otherDesc;
+ return (!has(CONFIGURABLE) || sameValue(configurable, other.configurable)) &&
+ (!has(ENUMERABLE) || sameValue(enumerable, other.enumerable)) &&
+ (!has(WRITABLE) || sameValue(writable, other.writable)) &&
+ (!has(VALUE) || sameValue(value, other.value));
+ }
+
+ @Override
public boolean equals(final Object obj) {
if (this == obj) {
return true;
--- a/nashorn/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/objects/GenericPropertyDescriptor.java Tue Feb 25 18:56:10 2014 +0530
@@ -149,6 +149,23 @@
}
@Override
+ public boolean hasAndEquals(final PropertyDescriptor other) {
+ if (has(CONFIGURABLE) && other.has(CONFIGURABLE)) {
+ if (isConfigurable() != other.isConfigurable()) {
+ return false;
+ }
+ }
+
+ if (has(ENUMERABLE) && other.has(ENUMERABLE)) {
+ if (isEnumerable() != other.isEnumerable()) {
+ return false;
+ }
+ }
+
+ return true;
+ }
+
+ @Override
public boolean equals(final Object obj) {
if (this == obj) {
return true;
--- a/nashorn/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/runtime/PropertyDescriptor.java Tue Feb 25 18:56:10 2014 +0530
@@ -151,5 +151,12 @@
* @return true if property exists in implementor
*/
public boolean has(Object key);
+
+ /**
+ * Check existence and compare attributes of descriptors.
+ *
+ * @return true if every field of this desc exists in otherDesc and has the same value.
+ */
+ public boolean hasAndEquals(PropertyDescriptor otherDesc);
}
--- a/nashorn/src/jdk/nashorn/internal/runtime/ScriptObject.java Thu Feb 20 20:00:48 2014 -0800
+++ b/nashorn/src/jdk/nashorn/internal/runtime/ScriptObject.java Tue Feb 25 18:56:10 2014 +0530
@@ -469,7 +469,7 @@
return true;
}
- if (currentDesc.equals(newDesc)) {
+ if (newDesc.hasAndEquals(currentDesc)) {
// every descriptor field of the new is same as the current
return true;
}
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/nashorn/test/script/basic/JDK-8030197.js Tue Feb 25 18:56:10 2014 +0530
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+/**
+ * JDK-8030197: Nashorn: Object.defineProperty() can be lured to change fixed NaN property
+ *
+ * @test
+ * @run
+ */
+
+function str(n) {
+ var a = new Uint8Array(new Float64Array([n]).buffer);
+ return Array.apply(null, a).reduceRight(
+ function(acc, v){
+ return acc + (v < 10 ? "0" : "") + v.toString(16);
+ }, "");
+}
+
+var o = Object.defineProperty({}, "NaN", { value: NaN })
+var str1 = str(o.NaN);
+Object.defineProperty(o, "NaN", { value: 0/0 })
+var str2 = str(o.NaN);
+if (str1 != str2) {
+ fail("NaN bit pattern changed");
+}