Level 6
Problem
Given a vulnerable builtin Array.prototype.functionMap(func):
- It takes a
PACKED_DOUBLE_ELEMENTSJSArray receiver and a JSFunction argument. - reinterpret_cast
elementsto aFixedDoubleArray, then for each elemente:- Trigger a custom JavaScript callback
func, with- Input: this double element
e - Output: any double element
o
- Input: this double element
- And store
otoe's original position.
- Trigger a custom JavaScript callback
Key Knowledge
- Side Effect based Array Element Type Confusion
- CVE-2018-4233
- Use this technique to construct Address Of & Fake Object primitive.