The attached fuzzed mp4 file can be loaded in Flash using the attached utility like this:

http://localhost/LoadMP4.swf?file=static_table_neg_index.mp4

The resulting crash on Linux x64 looks like this:

   0x00007f0f8388478b:	lea    0xa0548e(%rip),%rdx        # 0x7f0f84289c20
=> 0x00007f0f83884792:	mov    (%rdx,%rsi,8),%rdx
   0x00007f0f83884796:	mov    %rdx,0x19e48(%rbx)

rdx            0x7f0f84289c20	139704618490912
rsi            0xfffffffffffc0000	-262144

An 8-byte wide value is being loaded from a static table. The suspicion is that it's a function pointer, which could be serious.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

static_table_neg_index.mp4 8.0 MB Download

LoadMP4.as 1.0 KB Download