Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid memory address dereference in strlenext (in util/decompile.c:237) #115

Closed
fantasy7082 opened this issue Mar 7, 2018 · 1 comment

Comments

@fantasy7082
Copy link

Hi, i found a issue in the libming 0.4.8. It crashed in function strlenext .the details are below(ASAN):

./swftocxx 007-unknown-def-swf /dev/null 
#include <mingpp.h>


main(){
SWFMovie* m = new SWFMovie(48);

Ming_setScale(1.0);
m->setRate(48.187500);
m->setDimension(3992, 3680);

// SWF_SETBACKGROUNDCOLOR 
m->setBackground(0x30, 0x30, 0x30);

// SWF_DEFINESPRITE 

	//  MovieClip 12336 
SWFMovieClip* character12336 = new SWFMovieClip(); // 12336 frames 

// SWF_END 

// SWF_EXPORTASSETS 
m->addExport(character12336,"0000000000000000000");
m->writeExports();

// SWF_INITACTION 
// Might be more appropriate to use addInitAction here
m->add(new SWFInitAction(new SWFAction("if( !00000000 ) {\
  0000000.00000000 = R0;\
  R1 = 0000000.00000000.000000000;\
  0000000.00000000.0000 = function (00 /*=R2*/ ) {\
    var R3;\
    R3 = new 00000000();\
  };\
  00000000000000(R1,null,808464432);\
}\
")));

// SWF_DOACTION 
ASAN:SIGSEGV
=================================================================
==28219==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x0000004107fb bp 0x7fff4c7f4c70 sp 0x7fff4c7f4c50 T0)
    #0 0x4107fa in strlenext /root/libming-asan/util/decompile.c:237
    #1 0x4113f0 in getName /root/libming-asan/util/decompile.c:398
    #2 0x416882 in decompileGETVARIABLE /root/libming-asan/util/decompile.c:1741
    #3 0x41e5f5 in decompileAction /root/libming-asan/util/decompile.c:3224
    #4 0x41eba0 in decompileActions /root/libming-asan/util/decompile.c:3419
    #5 0x41eccd in decompile5Action /root/libming-asan/util/decompile.c:3441
    #6 0x40bd02 in outputSWF_DOACTION /root/libming-asan/util/outputscript.c:1551
    #7 0x40e331 in outputBlock /root/libming-asan/util/outputscript.c:2083
    #8 0x40f3d9 in readMovie /root/libming-asan/util/main.c:286
    #9 0x40fb0e in main /root/libming-asan/util/main.c:359
    #10 0x7f4233c1582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #11 0x401b58 in _start (/usr/local/libming-asan/bin/swftocxx+0x401b58)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/libming-asan/util/decompile.c:237 strlenext
==28219==ABORTING

POC FILE:https://github.com/fantasy7082/image_test/blob/master/007-unknown-def-swf

@hlef
Copy link
Contributor

hlef commented May 15, 2018

just another duplicate. Same as #128, #129 and #130, already reported, already fixed (3a000c7).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants