# Adobe Flash Player Out-of-Bound Access Vulnerability

Flash Player's RegExp named-group handling read ovector[99] out of bounds when nameIndex=49, yielding a fake-length string for ASLR bypass or code execution.

- Payout: $2,000
- Severity: high
- Program: Internet Bug Bounty
- Credited: hhj4ck
- Disclosed: 2015-03-25
- CVE: CVE-2013-0634, CVE-2014-0559, CVE-2015-0330
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/47012
- Library page: https://bugbountylibrary.com/r/h1%3A47012
- Tags: domain:desktop impact:integrity impact:rce kind:bounty platform:hackerone sev:high technique:chained technique:source-review vuln:dos vuln:memory-corruption

**Target:** ActionScript RegExp engine (RegExpObject named capture groups)
**Root cause:** Fixed-size int ovector[99] on the stack; nameIndex derived from count of left brackets can equal 49, so ovector[nameIndex*2+1]=ovector[99] reads past the array. The bounds check only rejected nameIndex>49, not ==49.
**Steps:**
1. Craft regex with 49 left brackets and a named group `?P<G2>` so nameIndex=49
2. Run `"Venus".match("(((...49...(?P<G2>))...)")` in ActionScript
3. Flash computes substring length as ovector[99]-ovector[98], reading saved EIP as length
4. AS3 receives a string with enormous fake length field
5. Use heap fengshui to turn the oversized string into arbitrary memory read/write
**How found:** Noticed ovector is a fixed stack array of 99 ints while nameIndex is fully attacker-controlled via bracket count; spotted the off-by-one in the check `nameIndex > 49` that permits nameIndex==49, making nameIndex*2+1==99 index past the array.
**Exploitation:** Attacker delivers crafted SWF/ActionScript to Flash Player (IE, Excel). The out-of-bounds ovector read produces a string with attacker-influenced length (saved EIP on Windows), enabling ASLR defeat and, with heap fengshui, arbitrary memory access leading to code execution in the host application context.
**Escalation:** Fake-length string from OOB read chained with heap fengshui to convert info leak into arbitrary read/write and code execution.
**Insight:** When a bounds check uses `>` against a size-derived constant, test the boundary value itself; here the array length 99 and the check 49 interact so index 99 slips through. Also: attacker-controlled group counts feeding fixed stack arrays are a reliable OOB primitive.