A PoC (source and SWF) are attached, along with a screenshot of the rendering of the uninitialized content into a Bitmap.

Sometimes, the PoC will render just a black image. To get things a bit more leaky, I found that playing a Flash video in a second tab whilst refreshing the PoC seems to do the trick reliably.

Unfortunately, this appears to be an incorrect fix for https://code.google.com/p/google-security-research/issues/detail?id=319.  Bug 319  used a zero mask to cause uninitialized memory, and that PoC does seem to be fixed. This latest PoC uses a non-zero but non-complete mask to achieve a similar affect.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

	shaderjobleak2.png 29.7 KB View Download

ShaderJobLeak2.swf 994 bytes Download

ShaderJobLeak2.as 1.3 KB Download