2015
12.18

There is a use-after-free in the TextField gridFitType setter. If it is set to an object with a toString method that frees the TextField, the property will be written after it is freed.

No Comment.

Add Your Comment

You must be logged in to post a comment.