js_sandbox, pwn666 (PlaidCTF 2016)

js_sandbox.patch

diff --git a/build/toolchain.gypi b/build/toolchain.gypi
index 9f4cedc478..b93c5c4962 100644
--- a/build/toolchain.gypi
+++ b/build/toolchain.gypi
@@ -158,6 +158,11 @@
     }],
   ],
   'target_defaults': {
+    'cflags': [
+        '-fPIC',
+        '-D_FORTIFY_SOURCE=2',
+        '-fstack-protector',
+    ],  
     'conditions': [
       ['v8_target_arch=="arm"', {
         'defines': [
diff --git a/samples/samples.gyp b/samples/samples.gyp
index 7e0608b213..5fdd55a385 100644
--- a/samples/samples.gyp
+++ b/samples/samples.gyp
@@ -60,6 +60,13 @@
       'sources': [
         'shell.cc',
       ],
+      'cflags': [
+        '-fPIE',
+      ],
+      'ldflags': [
+        '-pie',
+        '-Wl,-z,relro,-z,now',
+      ],
     },
     {
       'target_name': 'hello-world',
diff --git a/samples/shell.cc b/samples/shell.cc
index b89ffdd180..b9b47dc194 100644
--- a/samples/shell.cc
+++ b/samples/shell.cc
@@ -34,6 +34,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
 
 /**
  * This sample program shows how to implement a simple javascript shell
@@ -75,6 +76,7 @@ class ShellArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
 
 
 int main(int argc, char* argv[]) {
+  //alarm(15);
   v8::V8::InitializeICU();
   v8::V8::InitializeExternalStartupData(argv[0]);
   v8::Platform* platform = v8::platform::CreateDefaultPlatform();
@@ -123,6 +125,7 @@ v8::Local<v8::Context> CreateShellContext(v8::Isolate* isolate) {
       v8::String::NewFromUtf8(isolate, "print", v8::NewStringType::kNormal)
           .ToLocalChecked(),
       v8::FunctionTemplate::New(isolate, Print));
+/*      
   // Bind the global 'read' function to the C++ Read callback.
   global->Set(v8::String::NewFromUtf8(
                   isolate, "read", v8::NewStringType::kNormal).ToLocalChecked(),
@@ -131,6 +134,7 @@ v8::Local<v8::Context> CreateShellContext(v8::Isolate* isolate) {
   global->Set(v8::String::NewFromUtf8(
                   isolate, "load", v8::NewStringType::kNormal).ToLocalChecked(),
               v8::FunctionTemplate::New(isolate, Load));
+*/              
   // Bind the 'quit' function
   global->Set(v8::String::NewFromUtf8(
                   isolate, "quit", v8::NewStringType::kNormal).ToLocalChecked(),
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 5767ed219d..6d947aae30 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1042,7 +1042,7 @@ Type* Typer::Visitor::JSAddRanger(RangeType* lhs, RangeType* rhs, Typer* t) {
   results[0] = lhs->Min() + rhs->Min();
   results[1] = lhs->Min() + rhs->Max();
   results[2] = lhs->Max() + rhs->Min();
-  results[3] = lhs->Max() + rhs->Max();
+  results[3] = lhs->Max() + lhs->Max();
   // Since none of the inputs can be -0, the result cannot be -0 either.
   // However, it can be nan (the sum of two infinities of opposite sign).
   // On the other hand, if none of the "results" above is nan, then the actual