Adobe Flash - 'uint' Capacity Field

Source: https://code.google.com/p/google-security-research/issues/detail?id=504 The latest version of the Vector. length check in Flash 18,0,0,232 is not robust against memory corruptions such as heap overflows. While it’s no longer possible to obviously bypass the length check there’s still...