To reproduce, host the attached SWF and other files on a web server (e.g. localhost) and load it like this:

http://localhost/PlayManifest.swf?file=titl.mpd

The fault condition appears to be a wild copy. Sometimes, though, exploitable looking crashes are obtained, e.g. this one on Linux x64:

mov    0x30(%rax),%rax
rax            0x4141414141414141	4702111234474983745


To compile the .as file, I had to use special flags to flex:

mxmlc -target-player 14.0 -swf-version 25 -static-link-runtime-shared-libraries ./PlayManifest.as
(This also requires that you have v14.0 of playerglobals.swc installed. Any newer version should also be fine.)

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

PlayManifest.swf 7.4 KB Download

titl.mpd 622 bytes Download

PlayManifest.as 1.8 KB Download

titl.mp4 64.0 KB Download