tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

regress-390598.js (897B)

      1 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
      2 /* This Source Code Form is subject to the terms of the Mozilla Public
      3 * License, v. 2.0. If a copy of the MPL was not distributed with this
      4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      5 
      6 
      7 //-----------------------------------------------------------------------------
      8 var BUGNUMBER = 390598;
      9 var summary = 'array_length_setter is exploitable';
     10 var actual = 'No Crash';
     11 var expect = 'No Crash';
     12 
     13 //-----------------------------------------------------------------------------
     14 test();
     15 //-----------------------------------------------------------------------------
     16 
     17 function test()
     18 {
     19  printBugNumber(BUGNUMBER);
     20  printStatus (summary);
     21 
     22  function exploit() {
     23    var fun = function () {};
     24    fun.__proto__ = [];
     25    fun.length = 0x50505050 >> 1;
     26    fun();
     27  }
     28  exploit();
     29 
     30  reportCompare(expect, actual, summary);
     31 }