Adobe Flash MovieClip Transform Use-After-Free
Posted by deepcore on August 29, 2016 – 12:18 pm
There is a use-after-free in the Adobe Flash MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed.
Post a reply
You must be logged in to post a comment.