simonlindholm

Breakage from CSS single-line comments

//-style comments

Based on the hypothetical parsing rule: // is a single-line comment, unless that would cause it to contain { or }.

https://console.cloud.google.com/bigquery?sq=36769687750:c41ab4e44c0d42b0be84ff4466e22682

SELECT

simonlindholm

var fs = require("fs");
var Kattio = {
	_buf: new Buffer(1 << 14),
	_bufPos: 0,
	_bufLen: 0,
	_ensure: function() {
		if (this._bufPos === this._bufLen) {
			this._bufPos = 0;
			this._bufLen = fs.readSync(0, this._buf, 0, this._buf.length, null);
		}

simonlindholm

Keybase proof

I hereby claim:

• I am simonlindholm on github.
• I am simonlindholm (https://keybase.io/simonlindholm) on keybase.
• I have a public key ASDb0pN28sqNZe8GMR2mkeenn3ctqeYgFfLO7SMSvOwKAQo

To claim this, I am signing this object:

simonlindholm

#!/usr/bin/env python3

import sys
import struct
import argparse
from collections import namedtuple

REG = {
    "zero":0,
    "at":1,

simonlindholm

/**
 * Author: Simon Lindholm
 * Date: 2018-07-19
 * License: CC0
 * Source: own work
 * Description: Euclidean minimum spanning tree.
 * Add an "index" member to Point if you need indices returned.
 * Usage:
 * Q q; q.ps = ...;
 * q.init(0,0,1 << 30); // if 0 <= x,y < 2^30

simonlindholm

Last year's Battlecode engine did JVM instrumentation to sandbox players on the same team from each other, and to limit the amount of computation they were allowed to do. We found two fun vulnerabilities related to the latter part.

The first vulnerability

The process by which the bytecode instruction limitation was done was by decompiling .class files, adding in instruction-counting instructions in relevant places, and them re-compiling them and running the modified executable. More concretely, say the program contained a method like:

simonlindholm

// g++ -O2 -Wall -Wextra -shared -fPIC -o replace.so replace.cpp -I /opt/jdk/include/ -I /opt/jdk/include/linux/ -std=c++11 -L /opt/jdk/lib/server/ -ljvm -Wl,-rpath,/opt/jdk/lib/server/
// LD_PRELOAD=./replace.so java -classpath .:../battlecode/java Player

#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <dlfcn.h>
#include <link.h>
#include <atomic>

simonlindholm

// Async, for use in WebExtensions. CC0.

function* gifDecoder($) {
	var size, r, len;

	// Header
	if ($.avail < 6) yield $.Ensure(6);
	var header = $.read(6);
	if (header[0] != 0x47 || header[1] != 0x49 || header[2] != 0x46)
		return $.Error("not a gif");

simonlindholm

full
hål
krona
hund
kniv
snöre
häst
eka
klocka
matta

simonlindholm

#define _GNU_SOURCE
#include <bits/stdc++.h>
using namespace std;

/* mfbt basic SIMD wrappers. */

#include <math.h>
#include <stdint.h>

// Figure out how to get access to SIMD on the current compiler.