Adobe Flash MovieClip.attachMovie Use-After-Free
Posted by deepcore on December 18, 2015 – 9:47 pm
There is a use-after-free in MovieClip.attachMovie. If a string parameter has toString defined, a number parameter has valueOf defined or an object parameter has its constructor redefined, it can execute code and free the this object of the method, leading to a use-after-free.
Post a reply
You must be logged in to post a comment.