# Adobe Flash Player Out-of-Bound Read/Write Vulnerability

Malformed RegExp with forward references overflows Flash's fixed cworkspace stack buffer; stale local pointer during heap expansion causes OOB read/write, enabling ASLR bypass and potential RCE.

- Payout: $5,000
- Severity: high
- Program: Internet Bug Bounty
- Credited: hhj4ck
- Disclosed: 2015-03-11
- CVE: CVE-2014-0564
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/31408
- Library page: https://bugbountylibrary.com/r/h1%3A31408
- Tags: domain:desktop impact:data-leak impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:chained technique:source-review vuln:dos vuln:memory-corruption

**Target:** Flash Player ActionScript RegExp compiler (cworkspace)
**Root cause:** When cworkspace overflows, it is reallocated on the heap and pointers updated, but the update happens inside a recursive function so a local cworkspace pointer stays stale (stack address); subsequent copy reads/writes out of bounds between stale stack pointer and new heap block.
**Steps:**
1. Compile a malformed RegExp with forward references and large repetition, e.g. `new RegExp("(?:(VenusTech)(?2){0,1020}(b))?)")`
2. Repetitions fill the fixed-size stack cworkspace, triggering stack-overflow detection and heap reallocation
3. Recursive call leaves a stale local cworkspace pointer pointing to old stack memory
4. Copy operation reads from stale stack pointer to new heap block, causing OOB read (and write with heap fengshui)
5. Use OOB read to leak object/OS addresses to bypass ASLR, or corrupt Vector.<int> length for arbitrary R/W
**How found:** Code review of the RegExp compiler's cworkspace expansion mechanism: noticed pointer updates occur inside a recursive function, so local cworkspace pointer is not synchronized across calls, leaving a stale stack pointer used in the subsequent copy.
**Exploitation:** Attacker supplies crafted RegExp in Flash content; OOB read leaks sensitive memory addresses to defeat ASLR. With heap fengshui placing attacker-controlled heap adjacent to stack, the copy can overwrite a Vector.<int> length field, granting arbitrary memory read/write and ultimately code execution in the user's context.
**Escalation:** OOB read (ASLR bypass) chained with heap fengshui to corrupt Vector.<int> length for arbitrary R/W leading to RCE.
**Insight:** In recursive parsers/compilers that reallocate a growable buffer mid-recursion, check whether the buffer pointer is passed by reference or cached in locals across recursive frames; stale locals after realloc yield OOB copies between old and new buffers.