[CVE-2017-8741]: Limit JSON Stringify Loop to Initialized Portion

CustomExternalObjects can override the enumeration operations to
have side effects. In such a case, an object can be passed to an
invocation of JSON::Stringify, leading to stack values being used
inappropriately.

lib/Runtime/Library/JSON.cpp

@@ -689,7 +689,8 @@ namespace JSON
                             }
 
                             // walk the property name list
-                            for (uint k = 0; k < precisePropertyCount; k++)
+                            // Note that we're only walking up to index, not precisePropertyCount, as we only know that we've filled the array up to index
+                            for (uint k = 0; k < index; k++)
                             {
                                 propertyName = Js::JavascriptString::FromVar(nameTable[k]);
                                 scriptContext->GetOrAddPropertyRecord(propertyName->GetString(), propertyName->GetLength(), &propRecord);