It's possible to overwrite one byte of the dynamic memory with NULL within quartz.dll with crafted AVI file.
vulners.com/securityvulns/securityvulns:doc:9907
vulners.com/securityvulns/securityvulns:doc:9919