The vulnerability (CVE-2015-3864) is an imperfect patch for one of the issues reported by Joshua Drake, which has been fixed for Nexus devices in the September bulletin. The vulnerable code is in handling the tx3g chunk type when parsing video files. The issue with this patch is that chunk_size actually doesnt have type size_t; it is auint64_t even on 32-bit platforms. Its a promising looking bug from an exploitation perspective.”]
Source: https://googleprojectzero.blogspot.com/2015/09/stagefrightened.html