CVE-2020-17057

I wrote this exp based on this blog（https://blogs.360.cn/post/CVE-2020-17057%20detail%20and%20exploit.html），But I ended up with only palette objects with dangling data pointer. Because of type isolation, I can't get arbitrary R/W primitives by using palettes or bitmap objects，If you have a way to...