mpatch: be more careful about parsing binary patch data (SEC)
It appears to have been possible to trivially walk off the end of an
allocated region with a malformed patch. Oops.
Caught when writing an mpatch fuzzer for oss-fuzz.
This defect is OVE-20180430-0001. A CVE has not been obtained as of
this writing.
{
// Enforcing
"eqeqeq" : true, // true: Require triple equals (===) for comparison
"forin" : true, // true: Require filtering for..in loops with obj.hasOwnProperty()
"freeze" : true, // true: prohibits overwriting prototypes of native objects such as Array, Date etc.
"nonbsp" : true, // true: Prohibit "non-breaking whitespace" characters.
"undef" : true, // true: Require all non-global variables to be declared (prevents global leaks)
// Environments
"browser" : true // Web Browser (window, document, etc)
}