Apple iOS / OS X NSKeyedArchiver Memory Corruption(CVE-2017-2527)

CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method reads an Int "index" then passes that to builtinfunction mov ebx, edi -- controlled unsigned int mov r14d, ebx lea r15, ZL9functions0 ; functions mov rax, r15+r148 if rax is non-null it's returned as an objective-c...