Re: MSIE integer overflows

<snip>
> That's a strange result, but are you sure it's actually meaningful? I
Not true: "++i" will increase i first and return the result of that increased i where "i++" will return i and then increase it: -- example.js --
var i=1;
document.write(++i); // prints 2, i=2;
document.write(i++); // prints 2, i=3;
-- cut here --

<snip>
> Well the javascript interpreter seems like a not-so-good place to look.
The interpreter is not handling them sanely, alltough I have not found anything security related that's wrong. The examples clearly show that the interpreter and some of the internal methods return unexpected behaviour. I tried the array's first to see if I could read/overwrite any memory I would normally not have access to.

> The 'undefined' result you got when pop()ing 'c' is a little strange,
See
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/script56/ht ml/js56jsmthPop.asp
(url wrapped)
<quote>If the array is empty, undefined is returned.</quote> So somehow it's still popping the value but then it returns "undefined", meaning it thinks the array is empty. Btw. try a negative index on an array (like "i[-1]"): It doesn't work, its NOT a valid index.

Cheers,

Berend-Jan Wever Received on Wed May 14 12:09:32 2003