A SWF to reproduce is attached, along with source. To reproduce, host the additional resource SWF "imglossless8bpp.swf" on the same web server / directory as Lossless8bppLeak.swf
I'm fairly sure this is a very different bug to the "Lossless1bppLeak.swf" bug. To manifest this bug, we pull a fun little trick: we terminate the image data zlib stream early, before emitting any pixel data for the image. This leaves uninitialized data in the canvas which we can read out to script. The demo SWF file grabs a pointer value and displays it (64-bit Linux) to illustrate the point.
A screenshot is attached for convenience.
Since it's very easy to use this vulnerability to read uninitialized memory content, a 90-day disclosure deadline applies.
