# Don’t Follow The Masses: Bug Hunting in JavaScript Engines

Integer overflow in V8 Scanner::LiteralBuffer::NewCapacity during string scanning causes heap buffer overflow via a ~20GB quoted string literal.

- Payout: $7,500
- Severity: high
- Program: Google
- Credited: Dimitri Fourny
- Disclosed: 2019-04-29
- CVE: CVE-2019-5790
- Write-up quality: 7/10
- Original: https://labs.bluefrostsecurity.de/blog/2019/04/29/dont-follow-the-masses-bug-hunting-in-javascript-engines/
- Library page: https://bugbountylibrary.com/r/blog%3Alabs-bluefrostsecurity-de-blog-2019-04-29-dont-follow-the-masses-bug-hunting-in-javascript-engines
- Tags: domain:browser impact:rce kind:bounty platform:blog sev:high tech:chromium technique:source-review vuln:dos vuln:memory-corruption

**Target:** V8 JavaScript engine scanner (string literal buffer)
**Root cause:** NewCapacity computes capacity * kGrowthFactory which overflows int for huge string literals, returning a smaller new_capacity than position_; the subsequent MemCopy in ExpandBuffer writes past the newly allocated buffer.
**Steps:**
1. Read src/parsing Scanner::LiteralBuffer::AddTwoByteChar/ExpandBuffer/NewCapacity.
2. Note capacity* kGrowthFactory can overflow int when backing_store_.length() is huge.
3. Build a string: `let s = String.fromCharCode(0x4141).repeat(0x10000001) + "A"; s = "'"+s+"'"; eval(s);`
4. Trigger scan of the quoted literal so ExpandBuffer MemCopy overflows the heap buffer.
**How found:** Deliberately avoided the crowded JIT attack surface and instead read the parser/scanner code (src/parsing), spotting the unchecked integer multiplication in NewCapacity by code review rather than fuzzing.
**Exploitation:** Not weaponized in text; PoC triggers heap memory corruption in the scanner, requiring ~20GB memory and significant time.
**Insight:** Look at the tokenizer/scanner's buffer-growth arithmetic (capacity * growth factor) for integer overflows; these are missed by fuzzers because triggering requires enormous input sizes, so pure source review of size-calculation code pays off.