Adobe Flash Selection.setFocus Use-After-Free
Posted by deepcore on August 29, 2016 – 12:18 pm
There is a use-after-free in Adobe Flash Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object’s thread. Then, if it calls into script, for example, by calling toString on the string parameter, the object, and its thread will be deleted, and a use-after-free occurs.
Post a reply
You must be logged in to post a comment.