search

Temptationx / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Flash out-of-bounds read in uploadCompressedTextureFromByteArray() [CubeTexture variant] #82

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
[This is largely identical to 
https://code.google.com/p/google-security-research/issues/detail?id=71 with the 
difference that the errant API is called on CubeTexture instead of Texture]

A SWF to reproduce is attached, along with source. Note that the SWF must be 
loaded by an HTML embed (file also attached) so that wmode="direct" can be set 
in order to get the 3D APIs to work.

This is probably due to an integer overflow.

Note that this bug is almost certainly 64-bit only. The PoC relies on an 
allocation that is almost 4GB in size, and obviously such an allocation is 
never going to succeed in a 32-bit address space.

Also, the bug does not work in Chrome 64-bit Linux, because Chrome 64-bit Linux 
has a defense that limits total allocations to 4GB. The PoC still crashes the 
Flash process in Chrome, presumably due to a NULL pointer.

In order to repro fully, try 64-bit Flash in 64-bit IE, or run Chrome 64-bit 
Linux with the --no-sandbox flag (which disables the 4GB limit).

Original issue reported on code.google.com by cev...@google.com on 31 Jul 2014 at 5:48

Attachments:

GoogleCodeExporter commented 9 years ago

Original comment by cev...@google.com on 31 Jul 2014 at 7:01

GoogleCodeExporter commented 9 years ago

Original comment by cev...@google.com on 5 Sep 2014 at 10:58

GoogleCodeExporter commented 9 years ago 
http://helpx.adobe.com/security/products/flash-player/apsb14-21.html

Will derestrict in a week or so, etc.

Original comment by cev...@google.com on 9 Sep 2014 at 8:15

GoogleCodeExporter commented 9 years ago 
Making public.

Original comment by cev...@google.com on 23 Sep 2014 at 7:29