Exploiting an integer overflow with array spreading (WebKit) - phoenhex team

phoenhex.re

This article is about CVE-2017-2536 / ZDI-17-358 , a classic integer overflow while computing an allocation size, leading to a heap-based buffer overflow. It was introduced in 99ed479 , which improved the way JavaScriptCore handled.