Mozilla火狐浏览器中的一个Use-After-Free漏洞分析

PHA+TW96aWxsYSDlnKgyMDE45bm0MTLmnIjpgJrov4c8YSBocmVmPSJodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9zZWN1cml0eS9hZHZpc29yaWVzL21mc2EyMDE4LTI5LyIgdGFyZ2V0PSJfYmxhbmsiPm1mc2EyMDE4LTI5PC9hPuWPkeW4g+S6hueBq+eLkOa1j+iniOWZqDY05L2N55qE5paw54mI5pysLOivpeeJiOacrOS/ruWkjeS6huWHoOS4quS4pemHjeeahOWuieWFqOmXrumimO+8jOWFtuS4reWMheaLrCBDVkUtMjAxOC0xODQ5Mu+8jOi/meS4qkNWReaYr+WSjHNlbGVjdOWFg+e0oOebuOWFs+eahOS4gOS4qnVzZS1hZnRlci1mcmVlKFVBRinmvI/mtJ7jgILmiJHku6w8YSBocmVmPSJodHRwczovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20vYmxvZy8yMDE3LzYvMjYvdXNlLWFmdGVyLXNpbGVuY2UtZXhwbG9pdGluZy1hLXF1aWV0bHktcGF0Y2hlZC11YWYtaW4tdm13YXJlIiB0YXJnZXQ9Il9ibGFuayI+5LmL5YmNPC9hPuiuqOiuuui/h1VBRui/meenjea8j+a0nu+8jOW5tuS4lOaIkeS7rOWPr+S7peeci+WIsOWOguWVhuW3sue7j+WunueOsOWFqOmdoueahDxhIGhyZWY9Imh0dHBzOi8vd3d3LmJsYWNraGF0LmNvbS9kb2NzL3VzLTE1L21hdGVyaWFscy91cy0xNS1Hb3JlbmMtQWJ1c2luZy1TaWxlbnQtTWl0aWdhdGlvbnMtVW5kZXJzdGFuZGluZy1XZWFrbmVzc2VzLVdpdGhpbi1JbnRlcm5ldC1FeHBsb3JlcnMtSXNvbGF0ZWQtSGVhcC1BbmQtTWVtb3J5UHJvdGVjdGlvbi13cC5wZGYiIHRhcmdldD0iX2JsYW5rIj7kv53miqQ8L2E+5Lul5bCd6K+V5raI6Zmk5a6D5Lus44CC5L2G5Y2z5L2/5Zyo5LuK5aSp77yM5Zyod2Vi5rWP6KeI5Zmo5Lit5Y+R546w5ZKMVUFG55u45YWz55qE5ryP5rSe5Lmf5LiN5piv5aSq572V6KeB77yM5omA5Lul5LqG6Kej6L+Z5Lqb5ryP5rSe5a+55LqO5Y+R546w5ZKM5L+u5aSN6L+Z5Lqb6ZSZ6K+v5piv5Y2B5YiG6YeN6KaB55qE44CC6L+Z56+H5Y2a5a6i5Li76KaB5bGV546w5LqG6L+Z5LiqQ1ZF5LitVUFG5ryP5rSe55qE5pu05aSa57uG6IqC77yM5Lul5Y+K5Li65LqG6Kej5Yaz6L+Z5Liq5ryP5rSe6ICM5Y+R5biD55qE6KGl5LiB44CCPC9wPjxoMiBpZD0idG9jLTAiPua8j+a0nuinpuWPkTwvaDI+PHA+5Lul5LiL5LiA5q61cG9j5Luj56CB5Y+v5Lul55So5LqO6Kem5Y+R6L+Z5Liq5ryP5rSe77yaPC9wPjxwPjxpbWcgc3JjPSJodHRwczovL2Jicy56a2FxLmNuL3VwbG9hZC91c2VyZmlsZS8xOTMyLzU5MDIyYWMyYzYxN2QzODE3MzcyNTc0ZGI0NDRhNWUwLnBuZyIvPjwvcD48cD48YnIvPjwvcD48cD7lnKjkuIDkuKrlj5for6XmvI/mtJ7lvbHlk43niYjmnKznmoTngavni5DmtY/op4jlmajkuIrov5DooYzov5nmrrXku6PnoIHvvIzlvpfliLDku6XkuIvnmoTltKnmuoPkv6Hmga/lkozmiqXplJnkv6Hmga/vvJo8L3A+PHA+PGJyLz48L3A+PHA+PGltZyBzcmM9Imh0dHBzOi8vYmJzLnprYXEuY24vdXBsb2FkL3VzZXJmaWxlLzE5MzIvYjg4ODEyMzRjYzI3MjZkNzY2MWE5OGFlMWE2OTQyMmQucG5nIi8+PC9wPjxwPuS7peWPkeeOsO+8jOW9k+WvueS4gOS4quWhq+a7oTB4ZTVlNWU1ZTXnmoTlhoXlrZjlnLDlnYDop6PlvJXnlKjml7bvvIzkuqfnlJ/kuobor7vlj5borr/pl67lhrLnqoHjgILov5nkuKrlgLzmmK9qZW1hbGxvY+eUqOadpeKAnOavkuWMluKAneW3sumHiuaUvuWGheWtmOeahO+8jOaJgOiwk+KAnOavkuWMluKAneWwseaYr+S4uuS6huaWueS+v+WGheWtmOiviuaWre+8jOS9v+eUqOS4gOS4quWPr+ivhuWIq+eahOaooeW8j+adpeWhq+WFheW3sumHiuaUvuWGheWtmOOAguacgOWlveaYr+i/meS4queUqOS6juWhq+WFheeahOWAvOS4jeWvueW6lOS7u+S9leWPr+iuv+mXrueahOWcsOWdgO+8jOWmguatpOWPr+S7peWvvOiHtO+8jOS7u+S9leino+W8leeUqOW3suWhq+WFheWGheWtmOeahOWwneivle+8iOavlOWmgnVzZS1hZnRlci1mcmVl77yJ6YO95Lya56uL5Y2z5Lqn55Sf54m55a6a55qE5bSp5rqD44CCPC9wPjxoMiBpZD0idG9jLTEiPuaguea6kOWIhuaekDwvaDI+PHA+UG9j5Luj56CB5YyF5ousNuihjO+8jOaIkeS7rOS4gOihjOS4gOihjOadpeWIhuaekO+8mjwvcD48b2w+PGxpPuWIm+W7uuS4gOS4qmRpduWFg+e0oDwvbGk+PGxpPuWIm+W7uuS4gOS4qm9wdGlvbuWFg+e0oDwvbGk+PGxpPui/meS4qm9wdGlvbuWFg+e0oOiiq+mZhOWKoOWIsGRpduWFg+e0oO+8jOeOsOWcqOivpWRpduWFg+e0oOaYr29wdGlvbuWFg+e0oOeahOeItuWFg+e0oDwvbGk+PGxpPuS4uuivpWRpduWFg+e0oOa3u+WKoOS4gOS4quS6i+S7tuebkeWQrOWZqCBET01Ob2RlUmVtb3ZlZO+8jOi/meaEj+WRs+edgOWmguaenOWIoOmZpOS6hui/meS4qm9wdGlvbuiKgueCue+8jOWwseS8muiwg+eUqOaIkeS7rOaUvuWcqOi/memHjOeahOWHveaVsOOAgjwvbGk+PGxpPuWIm+W7uuS4gOS4qnNlbGVjdOWFg+e0oDxici8+6L+Z6YeM5rex5YWl5YiG5p6Q5LiA5LiL77yM5ZyoSmF2YVNjcmlwdOivreiogO+8jOW9k+WIm+W7uuS4gOS4qnNlbGVjdOWFg+e0oOaXtu+8jHh1bC5kbGwhTlNfTmV3SFRNTFNlbGVjdEVsZW1lbnTlh73mlbDkvJrkuLrov5nkuKpzZWxlY3TlhYPntKDliIbphY3kuIDkuKoweDExOOWtl+iKguWkp+Wwj+eahOWvueixoe+8mjwvbGk+PC9vbD48cD48YnIvPjwvcD48cD48aW1nIHNyYz0iaHR0cHM6Ly9iYnMuemthcS5jbi91cGxvYWQvdXNlcmZpbGUvMTkzMi8yNmUxNmM3MDAzN2ZhODkzZTljMGRkNmU4MDEwNDgyNS5wbmciLz48L3A+PHA+5Y+v5Lul55yL5Yiw77yM5Zyo5pyA5ZCO6Lez6L2s5Yiw5LqGbW96aWxsYTo6ZG9tOjpIVE1MU2VsZWN0RWxlbWVudDo6SFRNTFNlbGVjdEVsZW1lbnTlh73mlbDmiafooYzvvIzor6Xlh73mlbDlhoXlrrnlpoLkuIs8L3A+PHA+PGltZyBzcmM9Imh0dHBzOi8vYmJzLnprYXEuY24vdXBsb2FkL3VzZXJmaWxlLzE5MzIvZDdlMDhiNDFlMDUzMzYwZTQ3ZjNkZTJhOTRhZTNhODQucG5nIi8+PC9wPjxwPjxici8+PC9wPjxwPui/meS4quWHveaVsOWvueaWsOWIhumFjeWvueixoeeahOWQhOS4quWtl+autei/m+ihjOS6huWIneWni+WMlu+8jOatpOWklu+8jOi/mOWIm+W7uuS6huS4gOS4qjB4MzjlrZfoioLlpKflsI/nmoTlj6bkuIDkuKrlr7nosaHvvIzor6Xlr7nosaHnsbvlnovkuLpIVE1MT3B0aW9uc0NvbGxlY3Rpb27jgILpu5jorqTmg4XlhrXkuIvvvIzmr4/kuIDkuKpzZWxlY3TlhYPntKDpg73kvJrmnInkuIDkuKpvcHRpb25z6ZuG5ZCI44CC5YaN5p2l55yL5pyA5ZCO5LiA6KGM44CC56ys5LqM5q2l5Yib5bu655qEb3B0aW9u5YWD57Sg6KKr56e75Yqo5Yiw5LqGc2VsZWN05YWD57Sg55qEb3B0aW9uc+mbhuWQiOS4reOAguivpeaTjeS9nOS8muWvvOiHtG1vemlsbGE6OmRvbTo6SFRNTE9wdGlvbnNDb2xsZWN0aW9uOjpJbmRleGVkU2V0dGVy5Ye95pWw6KKr6LCD55So44CC5LiL5Zu+5piv5ZyoSURB5Lit55yL5Yiw55qE56iL5bqP6YC76L6R77yaPC9wPjxwPjxpbWcgc3JjPSJodHRwczovL2Jicy56a2FxLmNuL3VwbG9hZC91c2VyZmlsZS8xOTMyLzkwMWQyN2NiY2Q0M2ViY2I3Mjk0ODliMGYyNTI4YzU2LnBuZyIvPjwvcD48cD48YnIvPjwvcD48cD7ov5nph4zmtY/op4jlmajkvJrlgZrkuIDkupvmo4Dmn6XvvIzkvovlpoLvvIzlpoLmnpxvcHRpb27nmoTntKLlvJXlpKfkuo7lvZPliY1vcHRpb27pm4blkIjnmoTplb/luqbvvIxvcHRpb25z6ZuG5ZCI5Lya6LCD55SobW96aWxsYTo6ZG9tOjpIVE1MU2VsZWN0RWxlbWVudDo6U2V0TGVuZ3Ro5Ye95pWw5p2l5omp5aSn6ZuG5ZCI44CC5Zyo5LiK6Z2i55qEcG9j5Lit77yM56ys5YWt6KGM6K6+572u55qE5pivWzBd77yM5omA5Lul57Si5byV5YC85Li6MOOAguWcqOS4iuWbvueahOiTneiJsuWdl+mDqOWIhuaJp+ihjOS6huS4gOS4quajgOafpe+8jOWmguaenOimgeiuvue9rueahOe0ouW8leS4jeetieS6jm9wdGlvbumbhuWQiOeahOiuoeaVsO+8jOWImeaJp+ihjOWPs+WIhuaUr+OAguaIkeS7rHBvY+S4ree0ouW8leWAvOS4ujDvvIxvcHRpb27pm4blkIjnmoTorqHmlbDkuZ/kuLow77yM5omA5Lul5Lya5omn6KGM5bem5YiG5pSv77yM5Zug5q2k5omn6KGM5Yiw5LqGbnNJTm9kZTo6UmVwbGFjZU9ySW5zZXJ0QmVmb3Jl5Ye95pWw77yM5Y+v5Lul5Zyo5LiL5Zu+55qE57qi6Imy5Z2X5Yy65Z+f55yL5Yiw77yaPC9wPjxwPjxpbWcgc3JjPSJodHRwczovL2Jicy56a2FxLmNuL3VwbG9hZC91c2VyZmlsZS8xOTMyLzk2ZDUwYjBkNGM1N2YwY2ZlNmQ3NTBkY2Y2MGEwOWE4LnBuZyIvPjwvcD48cD7lnKggbnNJTm9kZTo6UmVwbGFjZU9ySW5zZXJ0QmVmb3Jl5Ye95pWw5Lit77yM6LCD55So5LqGbnNDb250ZW50VXRpbHM6Ok1heWJlRmlyZU5vZGVSZW1vdmVk5Ye95pWw5p2l6YCa55+l6KaB6KKr5Yig6Zmk5a+56LGh55qE54i25Lqy5a+56LGh77yM5aaC5p6c5a2Y5Zyo5a+56K+l5LqL5Lu255qE55uR5ZCs77yaPC9wPjxwPjxpbWcgc3JjPSJodHRwczovL2Jicy56a2FxLmNuL3VwbG9hZC91c2VyZmlsZS8xOTMyLzExMGY2ZmFjMzM3NjI4YjAwNjc5NjY2MjljNjNhODQwLnBuZyIvPjwvcD48cD7miJHku6zlnKjnrKw06KGM6K6+572u5LqG5a+5ZGl25YWD57Sg55qERE9NTm9kZVJlbW92ZWTkuovku7bnm5HlkKzlmajvvIzkuo7mmK/ov5nph4znmoTlh73mlbDkvJrooqvop6blj5HjgILlnKjov5nkuKrlh73mlbDph4zvvIzpppblhYhzZWzlj5jph4/lgLzkvJrooqvorr7nva7kuLow77yM6L+Z5bCG5Yig6Zmk5a+5c2VsZWN05YWD57Sg55qE5pyA5ZCO5LiA5Liq5byV55So44CC5LmL5ZCO77yM6K+l5Ye95pWw5Yib5bu65LqG5LiA5Liq5beo5aSn55qE5pWw57uE57yT5Yay5Yy677yM6L+Z5Liq5pON5L2c5Lya5Lqn55Sf5YaF5a2Y5Y6L5Yqb77yM5a+86Ie05Z6D5Zy+5Zue5pS256iL5bqP5byA5aeL5bel5L2c44CC5q2k5pe277yMc2VsZWN05YWD57Sg5a+56LGh5Lya6KKr6YeK5pS+55Sx5LqO5YW2546w5Zyo5LiN5a2Y5Zyo5Lu75L2V55qE5byV55So77yM6L+Z5Z2X6YeK5pS+55qE5YaF5a2Y5Lya6KKr5aGr5YWFMHhlNWU1ZTVlNeOAguacgOWQju+8jOWHveaVsOiwg+eUqGFsZXJ05p2lPGEgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXIubW96aWxsYS5vcmcvZW4tVVMvZG9jcy9XZWIvSmF2YVNjcmlwdC9FdmVudExvb3AjTmV2ZXJfYmxvY2tpbmciIHRhcmdldD0iX2JsYW5rIj7liLfmlrDmjILotbfnmoTlvILmraXku7vliqE8L2E+77yM5ZyobnNDb250ZW50VXRpbHM6Ok1heWJlRmlyZU5vZGVSZW1vdmVk5Ye95pWw6L+U5Zue5pe277yM6KKr6YeK5pS+55qEc2VsZWN05a+56LGh5Lya6KKr55So5p2l6K+75Y+W5LiA5Liq5oyH6ZKI77yM5LuO6ICM5a+86Ie06K+75Y+W6K6/6Zeu5Yay56qB77yaPC9wPjxwPjxpbWcgc3JjPSJodHRwczovL2Jicy56a2FxLmNuL3VwbG9hZC91c2VyZmlsZS8xOTMyLzZkMmJiZTFiOTBiYmIwZDExY2U4NTE2NTczZWNmYzgxLnBuZyIvPjwvcD48cD7mnInotqPnmoTmmK/vvIzlpoLmnpzmiafooYznmoTmmK/lj7PliIbmlK/vvIzov5jmmK/kvJrosIPnlKjlrozlhajnm7jlkIznmoTlh73mlbAobnNJTm9kZTo6UmVwbGFjZU9ySW5zZXJ0QmVmb3JlKSzkvYbmmK/lnKjosIPnlKjkuYvliY3vvIxBZGRSZWblh73mlbDkvJrooqvosIPnlKjku6Xlop7liqBzZWxlY3Tlr7nosaHnmoTlvJXnlKjorqHmlbDvvIzlm6DmraTvvIzkuI3kvJrlh7rnjrB1c2UtYWZ0ZXItZnJlZeeahOmXrumimO+8mjwvcD48cD48aW1nIHNyYz0iaHR0cHM6Ly9iYnMuemthcS5jbi91cGxvYWQvdXNlcmZpbGUvMTkzMi8yM2IwZTJmZDEyMTlhNmM0OGRhODYxYzIyZWNmYWU2YS5wbmciLz48L3A+PGgyIGlkPSJ0b2MtMiI+6KGl5LiBPC9oMj48cD5Nb3ppbGxh6YCa6L+HPGEgaHJlZj0iaHR0cHM6Ly9oZy5tb3ppbGxhLm9yZy9tb3ppbGxhLWNlbnRyYWwvcmV2L2Q0ZjNlMTE5YWU4NDEwMDhjMWJlNTllNzJlZTBhMDU4ZTM4MDNjZjMiIHRhcmdldD0iX2JsYW5rIj5kNGYzZTExOWFlODQxMDA4YzFiZTU5ZTcyZWUwYTA1OGUzODAzY2YzPC9hPuS/ruWkjeS6huivpea8j+a0nuOAguS4u+imgeWPmOWMluaYr29wdGlvbnPpm4blkIjkuK3lr7lzZWxlY3TlhYPntKDlr7nosaHnmoTlvLHlvJXnlKjooqvmm7/mjaLkuLrkuoblvLrlvJXnlKjvvJo8L3A+PHA+PGJyLz48L3A+PHA+PGltZyBzcmM9Imh0dHBzOi8vYmJzLnprYXEuY24vdXBsb2FkL3VzZXJmaWxlLzE5MzIvZDFkN2IxMWJhOGQ5YWIyYjg4MWE4Yjc1MDA1MDI5YTYucG5nIi8+PC9wPjxwPjxici8+PC9wPjxoMiBpZD0idG9jLTMiPuaAu+e7kzwvaDI+PHA+5bC9566hVUFG5ryP5rSe5piv5LiA56eN5LyX5omA5ZGo55+l55qE6Zeu6aKY77yM5L2G5piv5a+55LqO5aSn5aSa5pWw5rWP6KeI5Zmo5p2l6K+077yM5a6D5LuN54S25piv5LiA5Liq6Zeu6aKY77yM5bCx5Zyo5Yeg5Liq5pyI5YmN77yM6ZKI5a+56LC35q2MQ2hyb21l55qE5pS75Ye75bCx5L2/55So5LqGVUFG5ryP5rSe44CC5b2T54S277yMVUFG5ryP5rSe5Lmf5a2Y5Zyo5LiO5rWP6KeI5Zmo5LmL5aSW44CCTGludXjlhoXmoLjlj5HluIPkuobkuIDkuKo8YSBocmVmPSJodHRwczovL2JpdC10ZWNoLm5ldC9uZXdzL3RlY2gvc29mdHdhcmUvbGludXgtaGl0LWJ5LXVzZS1hZnRlci1mcmVlLXZ1bG5lcmFiaWxpdHkvMS8iIHRhcmdldD0iX2JsYW5rIj7ooaXkuIE8L2E+5p2l6Kej5Yaz55SxVUFG5ryP5rSe5byV6LW355qE5ouS57ud5pyN5Yqh6Zeu6aKY44CC5LqG6KejVUFG5ryP5rSe5aaC5L2V5Y+R55Sf5pe25qOA5rWL5LuW5Lus55qE5YWz6ZSu77yM5LiO57yT5Yay5Yy65rqi5Ye65ryP5rSe57G75Ly877yM5oiR5Lus5LiN5aSq5Y+v6IO95Zyo6L2v5Lu25Lit55yL5YiwVUFG5ryP5rSe55qE57uI57uT77yM5L2G5piv77yM6YCC5b2T55qE57yW56CB6KeE6IyD5ZKM5a6J5YWo5byA5Y+R5a6e6Le15Y+v5Lul5biu5Yqp5oiR5Lus5raI6Zmk5oiW6Iez5bCR5piv5YeP5bCP5pyq5p2lVUFG5ryP5rSe5Lqn55Sf55qE5b2x5ZON44CCPC9wPjxwPuWOn+aWh+mTvuaOpe+8mjxici8+PGEgaHJlZj0iaHR0cHM6Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tL2Jsb2cvMjAxOS83LzEvdGhlLWxlZnQtYnJhbmNoLWxlc3MtdHJhdmVsbGVkLWEtc3Rvcnktb2YtYS1tb3ppbGxhLWZpcmVmb3gtdXNlLWFmdGVyLWZyZWUtdnVsbmVyYWJpbGl0eSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbS9ibG9nLzIwMTkvNy8xL3RoZS1sZWZ0LWJyYW5jaC1sZXNzLXRyYXZlbGxlZC1hLXN0b3J5LW9mLWEtbW96aWxsYS1maXJlZm94LXVzZS1hZnRlci1mcmVlLXZ1bG5lcmFiaWxpdHk8L2E+PC9wPjxwPjxici8+PC9wPjxwPui9rOiHquWFiOefpeekvuWMujxici8+PC9wPg==