Engineering Heap Overflow Exploits with JavaScript
Mark H. Daniel, Jake Honoroff, Charlie Miller · 2008
This paper presents a new technique for exploiting heap overflows in JavaScript interpreters. Briefly, given a heap overflow, JavaScript commands can be used to insure that a function pointer is reliably present for smashing, just after the overflown buffer. A case study serves to highlight the technique: the Safari exploit that the authors used to win the 2008 CanSecWest Pwn2Own contest. 1