Security researcher regenrecht reported via TippingPoint's Zero Day
Initiative that JavaScript arrays were vulnerable to an integer overflow
vulnerability. The report demonstrated that an array could be constructed
containing a very large number of items such that when memory was allocated
to store the array items, the integer value used to calculate the buffer
size would overflow resulting in too small a buffer being allocated.
Subsequent use of the array object could then result in data being written
past the end of the buffer and causing memory corruption.