CVE-2019-16452 Fails

[herronto]

I believe it is failing due to SPRAY_IDX being zero. T[2] doesn't appear to exist.

Sound object and element buffer was able to be reclaimed, WRITE_ARRAY_ADDR was 2a6ab348, SPRAY_IDX was 0, ESCRIPT_BASE was -2784d0, assert pops up.

Any help with this would be appreciated.

[herronto]

Apologies, the error was further down. The assert was popping up because ESCRIPT_BASE was negative. That was happening because myread(WRITE_ARRAY_ADDR+12) evaluates to 0, which comes from myread returning s2h(T[2]).

[zuypt]

WRITE_ARRAY_ADDR looks correct so maybe the exploit fails to search for the ESCRIPT_BASE. You can debug the exploit to figure out why