{"action":"closed","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/150","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/150/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/150/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/150/events","html_url":"https://github.com/chrsmith/google-security-research/issues/150","id":58936992,"number":150,"title":"File Reference Object Constructor Does Not Clear Destructor","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2015-0305","name":"CVE-2015-0305","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-natashenka","name":"Finder-natashenka","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2015-Jan-13","name":"Fixed-2015-Jan-13","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Id-3120","name":"Id-3120","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-Flash","name":"Product-Flash","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Nov-3","name":"Reported-2014-Nov-3","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-Moderate","name":"Severity-Moderate","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Adobe","name":"Vendor-Adobe","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-25T17:16:40Z","updated_at":"2015-02-25T17:16:41Z","closed_at":"2015-02-25T17:16:41Z","body":"```\nWhen a file reference object is created, the type and user data of the object \nare set, but the destructor function is not cleared. This means that if the \nfile reference object is constructed with a 'this' object that already has a \ndestructor, it will get called on the wrong type of data when the object is \ndestroyed, leading to native method calls on an object of the wrong type, which \nis usually exploitable.\n\nA sample SWF is attached, it works as follows:\n\n1) Pressing the full blue square on the left of the attached SWF will cause a \nFileReferenceList to be created. After it is created, the FileReference \nconstructor is overwritten as follows:\n\nvar b = flash.net;\nb.FileReference = q;\n\nThis code overwrites the FileReference constructor with method q.\n\n2) browse() is then called on the FileReferenceList, causing a file selection \ndialog to be spawned\n\n3) If the user selects a file, the function q will be called to construct a \nFileReference to hold the file the user selected. q is defined as:\n\nthis.f = flash.display.BitmapData\nvar c = new this.f(1000, 1000, true, 1000)\n\nNote that Flash CS3 doesn't build this code as expected, and I had to manually \ncorrect a few actions in the SWF.\n\nCalling this method causes the this object passed into the constructor to be \ninitialized as type BitmapData, which sets the BitmapData destructor. After the \nmethod is exited, the browse function sets the type of the returned object to \nbe a FileReferenceObject, but doesn't clear the destructor.\n\n4) A crash will occur when GC happens, the button on the right of the poc can \nbe used to trigger GC with limited reliability if the crash doesn't happen \nright away.\n\nPOC SWF is attached. This issue is marked as moderate, as \nFileReferenceList.browse always requires user interaction.\n```\n\n-----\nOriginal issue reported on code.google.com by `natashe...@google.com` on 30 Oct 2014 at 11:00\n\nAttachments:\n* [fdestroy9.swf](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-150/comment-0/fdestroy9.swf)\n"}}