The attached fuzzed flv file can be loaded in Flash using the attached utility like this:
http://localhost/LoadMP4.swf?file=yuv.flv
It crashes on both Linux x64 and Windows 32-bit, interestingly with the same pointer value:
=> 0x00007f0f83b21591: movdqu %xmm7,0x10(%rax)
rax 0x453b0cf0 1161497840
xmm7: uint128 = 0xff7f827fff7f827fff7f827fff7f827f
That pointer value is unlikely to be mapped on 64-bit, but it's in a readily reachable location on 32-bit. Changing the input file might get better control of rax -- this has not been investigated.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
