Running the attached PoC causes memory corruption, of this variety (Linux x64):

Program received signal SIGSEGV, Segmentation fault.
0x00007fad00ae9c2e in ?? ()
=> 0x00007fad00ae9c2e:	mov    0x350(%rax),%eax
rax            0x4141414141414141	4702111234474983745

The PoC spews 0x41 fairly indiscriminately on to the heap so it's little surprise we hit a pointer.


The width and height (8192 x 8192) are multiplied by 64 (a value in the shader), leading to integer overflow and subsequent havoc.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

ShaderInputOverflow.swf 951 bytes Download

ShaderInputOverflow.as 1.3 KB Download