A heap overflow in the FFmpeg MagicYUV decoder lets a crafted AVI file run code when you play it in VLC. See how the exploit works and how to protect yourself.