The attached fuzzed mp4 file can be loaded in Flash using the attached utility like this:
http://localhost/LoadMP4.swf?file=video_renders_ptrs.mp4
It takes a few seconds to settle, either rendering a black screen or some apparent out-of-bounds content. To maximize the chances of seeing some out-of-bounds content, run the PoC a few times in parallel.
Some nice pictures are attached illustrating what a pointer looks like on 32-bit Windows vs. 64-bit Windows 7 vs. 64-bit Linux :D
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
