1

Here there is a thorough description of the exploit I am talking about. There is this step:

var x1 = new Array();
for (i = 0; i < 200; ++i) {
    x1[i] = document.createElement("COMMENT");
    x1[i].data="abc";
};
var e1 = null;

where they fill x1 with the string "abc". Inside the post, they stated, that they would explain later, why this is necessary. But apparently, they forgot it.

In one of the last code sections they state:

And guess what, the system will reuse the memory that was allocated for the IMG object, which is now free for everyone. This means that the attacker has overwritten the IMG object with the data he wants.

Related Code Section:

function ev2() {
    p = "\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d";
    for (i = 0; i < x1.length; ++i) {
        x1[i].data = p;
    }

    var t = e1.srcElement;
}

They are talking about x1 which gets reassigned in this part of the code.

Altogether, I don't get, why they filled the array with "abc" on the first hand and second, I don't understand, why x1 should now place the reassigend data at a different location (the IMG object location) in the heap than the previously assigned "abc" value.

  • 1
    Hey Lavair, welcome to the site! Replacing the images of code with properly formatted text will allow answerers to copy-paste the code directly, which is super helpful. – Cowthulhu Jun 7 at 21:49
  • 1
    @Cowthulhu Hi, thanks for the tip. Gonna do it in a minute :) – Lavair Jun 7 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.