CVE-2019-1052

wyrichte · pleath · commit 66ab97c09c49 · 2019-06-10T16:08:50.000-07:00
diff --git a/lib/Backend/GlobOpt.cpp b/lib/Backend/GlobOpt.cpp
@@ -1244,7 +1244,7 @@ void GlobOpt::InsertValueCompensation(
         {
             IR::Instr *const newInstr =
                 IR::Instr::New(
-                    Js::OpCode::Ld_I4,
+                    Js::OpCode::Ld_A,
                     IR::RegOpnd::New(mergedHeadSegmentLengthSym, mergedHeadSegmentLengthSym->GetType(), func),
                     IR::RegOpnd::New(predecessorHeadSegmentLengthSym, predecessorHeadSegmentLengthSym->GetType(), func),
                     func);

Original file line number	Diff line number	Diff line change
`@@ -1244,7 +1244,7 @@ void GlobOpt::InsertValueCompensation(`
`1244`	`1244`	`{`
`1245`	`1245`	`IR::Instr *const newInstr =`
`1246`	`1246`	`IR::Instr::New(`
`1247`		`- Js::OpCode::Ld_I4,`
	`1247`	`+ Js::OpCode::Ld_A,`
`1248`	`1248`	`IR::RegOpnd::New(mergedHeadSegmentLengthSym, mergedHeadSegmentLengthSym->GetType(), func),`
`1249`	`1249`	`IR::RegOpnd::New(predecessorHeadSegmentLengthSym, predecessorHeadSegmentLengthSym->GetType(), func),`
`1250`	`1250`	`func);`