js/src/tests/js1_5/Function/regress-364023.js@6474c204b198 (annotated)
js/src/tests/js1_5/Function/regress-364023.js
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
| michael@0 | 1 | /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ |
| michael@0 | 2 | /* This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 3 | * License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 4 | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| michael@0 | 5 | |
| michael@0 | 6 | //----------------------------------------------------------------------------- |
| michael@0 | 7 | var BUGNUMBER = 364023; |
| michael@0 | 8 | var summary = 'Do not crash in JS_GetPrivate'; |
| michael@0 | 9 | var actual = 'No Crash'; |
| michael@0 | 10 | var expect = 'No Crash'; |
| michael@0 | 11 | |
| michael@0 | 12 | |
| michael@0 | 13 | //----------------------------------------------------------------------------- |
| michael@0 | 14 | test(); |
| michael@0 | 15 | //----------------------------------------------------------------------------- |
| michael@0 | 16 | |
| michael@0 | 17 | function test() |
| michael@0 | 18 | { |
| michael@0 | 19 | enterFunc ('test'); |
| michael@0 | 20 | printBugNumber(BUGNUMBER); |
| michael@0 | 21 | printStatus (summary); |
| michael@0 | 22 | |
| michael@0 | 23 | function exploit() { |
| michael@0 | 24 | var code = ""; |
| michael@0 | 25 | for(var i = 0; i < 0x10000; i++) { |
| michael@0 | 26 | if(i == 125) { |
| michael@0 | 27 | code += "void 0x10000050505050;\n"; |
| michael@0 | 28 | } else { |
| michael@0 | 29 | code += "void " + (0x10000000000000 + i) + ";\n"; |
| michael@0 | 30 | } |
| michael@0 | 31 | } |
| michael@0 | 32 | code += "function foo() {}\n"; |
| michael@0 | 33 | eval(code); |
| michael@0 | 34 | } |
| michael@0 | 35 | exploit(); |
| michael@0 | 36 | |
| michael@0 | 37 | reportCompare(expect, actual, summary); |
| michael@0 | 38 | |
| michael@0 | 39 | exitFunc ('test'); |
| michael@0 | 40 | } |
