Adobe Flash - textfield.maxChars Use-After-Free

Adobe Flash - textfield.maxChars Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581 There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's parent...