SEGV in parseSWF_SHAPERECORD (util/parser.c)

[acidghost]

There is an access violation in parseSWF_SHAPERECORD that generates a segmentation fault at util/parser.c:473. I'm testing version 0.4.8 on Ubuntu 16.04.04, kernel 4.13.16-041316-generic. To reproduce extract from the attached archive and:

$ ulimit -v $[200 * 1024]
$ listswf POC_input

gdb's bt and exploitable's output:

Program received signal SIGSEGV, Segmentation fault.
parseSWF_SHAPERECORD (f=f@entry=0x62a030, shape=0x90fc0, fillBits=fillBits@entry=0x7fffffffd4e0, lineBits=lineBits@entry=0x7fffffffd4e4, level=level@entry=3) at parser.c:473
473	  memset (shape, 0, sizeof (SWF_SHAPERECORD));
#0  parseSWF_SHAPERECORD (f=f@entry=0x62a030, shape=0x90fc0, fillBits=fillBits@entry=0x7fffffffd4e0, lineBits=lineBits@entry=0x7fffffffd4e4, level=level@entry=3) at parser.c:473
#1  0x00000000004120ed in parseSWF_SHAPE (f=f@entry=0x62a030, shape=0x7fffebeab740, level=level@entry=3, len=<optimized out>) at parser.c:851
#2  0x0000000000414b5e in parseSWF_DEFINEFONT2 (f=0x62a030, length=<optimized out>) at parser.c:1805
#3  0x000000000040141e in readMovie (f=0x62a030) at main.c:265
#4  main (argc=<optimized out>, argv=<optimized out>) at main.c:350
Description: Access violation on destination operand
Short description: DestAv (8/22)
Hash: 4db5dad42fed8ea232af42c20381d6b0.4db5dad42fed8ea232af42c20381d6b0
Exploitability Classification: EXPLOITABLE
Other tags: AccessViolation (21/22)

SIGSEGV.PC.4112b4.STACK.18f4b40955.CODE.1.ADDR.(nil).INSTR.mov____%al,(%rbx).fuzz.zip