The attached fuzzed mp4 file can be loaded in Flash using the attached utility like this:
http://localhost/LoadMP4.swf?file=cabac_wild.mp4
The resulting crash is surprisingly deterministic on Linux x64, always looking like this:
0x00007f0f83912c70: mov %rsi,0x418(%rdi)
=> 0x00007f0f83912c77: movzbl (%rsi),%edx
rsi 0x1808121a502959a4 1731653960947292580
It's the value of rsi that is always surprisingly similar.
Filing as a "medium" severity issue because it's only immediately obvious that the pointer is used for byte-by-byte reads.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
