In CVE-2015-6764 exploit, function leak_textobj_elements_pointer() can be used to get the textobj_elements_pointer. But why does it work?
I figure out that g_textobj_pointer stored in the second InternalField of JSObject. What type is this pointer and when does it be assigned?
Thank u so much.
In CVE-2015-6764 exploit, function
leak_textobj_elements_pointer()can be used to get thetextobj_elements_pointer. But why does it work?I figure out that
g_textobj_pointerstored in the secondInternalFieldofJSObject. What type is this pointer and when does it be assigned?Thank u so much.