Locked Exploits WebKit JSC JIT Use-After-Free

[1337day-Exploits]

The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to determine whether to insert write barriers. But it is missing some cases such as StringCharAt, StringCharCodeAt and GetByVal that might cause a garbage collection via rope strings. As a result, it can lead to a use-after-free condition.

This is the hidden content, please

• Sign In
• or
• Sign Up