Adobe Flash MovieClip.lineStyle Use-After-Free

There are a number of use-after-frees in MovieClip.lineStyle. If any of the String parameters are an object with toString defined, the toString method can delete the MovieClip, which is subsequently used.

Leave a Reply