tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

regress-364023.js (1055B)

      1 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
      2 /* This Source Code Form is subject to the terms of the Mozilla Public
      3 * License, v. 2.0. If a copy of the MPL was not distributed with this
      4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      5 
      6 //-----------------------------------------------------------------------------
      7 var BUGNUMBER = 364023;
      8 var summary = 'Do not crash in JS::GetPrivate';
      9 var actual = 'No Crash';
     10 var expect = 'No Crash';
     11 
     12 
     13 //-----------------------------------------------------------------------------
     14 test();
     15 //-----------------------------------------------------------------------------
     16 
     17 function test()
     18 {
     19  printBugNumber(BUGNUMBER);
     20  printStatus (summary);
     21 
     22  function exploit() {
     23    var code = "";
     24    for(var i = 0; i < 0x10000; i++) {
     25      if(i == 125) {
     26        code += "void 0x10000050505050;\n";
     27      } else {
     28        code += "void " + (0x10000000000000 + i) + ";\n";
     29      }
     30    }
     31    code += "function foo() {}\n";
     32    eval(code);
     33  }
     34  exploit();
     35 
     36  reportCompare(expect, actual, summary);
     37 }