Safari Browser: Builtin JavaScript allows Function.caller to be used in strict mode(CVE-2017-2446)

If a builtin script in webkit is in strict mode, but then calls a function that is not strict, this function is allowed to call the Function. caller and can obtain a reference to the strict function. This is inconsistent with the behavior when executing non-builtin scripts in Safari, and the behavior in other browsers, where having a single strict function on the call stack where calls to the Function. caller up to and including the first call to a strict function. This difference allows several sensitive native functions, such as arrayProtoPrivateFuncAppendMemcpy to be called directly, without the JavaScript wrappers that provide type and length checks.

A minimal example of this issue is as follows, and a full example is attached.

`` var q; function g(){ q = g. caller; return 7; }

var a = [1, 2, 3]; a. length = 4; Object. defineProperty(Array. prototype, “3”, {get : g}); [4, 5, 6]. concat(a); q(0x77777777, 0x77777777, 0); ``

I strongly recommend this issue be fixed by changing the behaviour of the Function. caller in strict mode, versus making changes to the natives, as it likely causes many similar problems

Attachment: strict.html