Adobe Flash Stage.align Use-After-Free
Posted by deepcore on August 29, 2016 – 12:18 pm
There is a use-after-free in the Adobe Flash Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free prevention changes. This conversion can invoke script, which if the this object is a MovieClip, can delete the object, deleting the thread the call is made from, which can lead to a use-after-free.
Post a reply
You must be logged in to post a comment.