Adobe Flash TextField.replaceText Use-After-Free
Posted by deepcore on December 18, 2015 – 9:47 pm
There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with valueOf defined, the parent object of the TextField can be used after it is freed.
Post a reply
You must be logged in to post a comment.