Team: Beached As

NACL applications that receive handles as input verify that the Javascript
variables being passed are indeed objects. However, there is no
verification that the object being passed is actually an UnknownHandle
object. An arbitrary object type can be passed and will be erroneously cast
to an UnknownHandle object, which leads to invalid memory access and
potential arbitrary execution. The sample program crashes trying to jump to
an invalid location in memory (which varies depending on the state of the
heap at the time).

	sprcgoodcrash.zip
	197 KB Download