pwn-learning/JavaScript/PwnCollegeV8Exploitation/Level4

Level 4

Problem

Given a vulnerability which can set an array's length by using Array.prototype.setLength().

Key Knowledge

• Heap Fengshui
• OOB Access other heap content by corrupting array's length