You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
root@ubuntu:/home/tim/asan/libming/util# ./swftocxx crashes/008-heap-over-swf-out_of_bound-idx\:0x1341-0x0
header indicates a filesize of 522 but filesize is 2748
#include <mingpp.h>
main(){
SWFMovie* m = new SWFMovie(48);
Ming_setScale(1.0);
m->setRate(48.187500);
m->setDimension(3992, 3680);
// SWF_SETBACKGROUNDCOLOR
m->setBackground(0x30, 0x30, 0x30);
// SWF_DEFINESPRITE
// MovieClip 12336
SWFMovieClip* character12336 = new SWFMovieClip(); // 12336 frames
// SWF_END
// SWF_EXPORTASSETS
m->addExport(character12336,"0000000000000000000");
m->writeExports();
// SWF_INITACTION
// Might be more appropriate to use addInitAction here
m->add(new SWFInitAction(=================================================================
==79668==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000158 at pc 0x557eae4e9cef bp 0x7ffd34d753b0 sp 0x7ffd34d753a0
READ of size 8 at 0x60b000000158 thread T0
#0 0x557eae4e9cee in getString /home/tim/asan/libming/util/decompile.c:370
#1 0x557eae4ec5f6 in decompilePUSHPARAM /home/tim/asan/libming/util/decompile.c:853
#2 0x557eae4efc3f in decompileSETMEMBER /home/tim/asan/libming/util/decompile.c:1795
#3 0x557eae4f7d75 in decompileAction /home/tim/asan/libming/util/decompile.c:3295
#4 0x557eae4f833e in decompileActions /home/tim/asan/libming/util/decompile.c:3494
#5 0x557eae4f5e57 in decompileDEFINEFUNCTION /home/tim/asan/libming/util/decompile.c:2834
#6 0x557eae4f7f56 in decompileAction /home/tim/asan/libming/util/decompile.c:3354
#7 0x557eae4f833e in decompileActions /home/tim/asan/libming/util/decompile.c:3494
#8 0x557eae4f4749 in decompileIF /home/tim/asan/libming/util/decompile.c:2656
#9 0x557eae4f7eb3 in decompileAction /home/tim/asan/libming/util/decompile.c:3335
#10 0x557eae4f833e in decompileActions /home/tim/asan/libming/util/decompile.c:3494
#11 0x557eae4f8474 in decompile5Action /home/tim/asan/libming/util/decompile.c:3517
#12 0x557eae4e59b8 in outputSWF_INITACTION /home/tim/asan/libming/util/outputscript.c:1860
#13 0x557eae4e6aa2 in outputBlock /home/tim/asan/libming/util/outputscript.c:2083
#14 0x557eae4e7b98 in readMovie /home/tim/asan/libming/util/main.c:281
#15 0x557eae4e8332 in main /home/tim/asan/libming/util/main.c:354
#16 0x7f569f5c4b6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
#17 0x557eae4da479 in _start (/home/tim/asan/libming/util/swftocxx+0x14479)
0x60b000000158 is located 0 bytes to the right of 104-byte region [0x60b0000000f0,0x60b000000158)
allocated by thread T0 here:
#0 0x7f569f9ff448 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10c448)
#1 0x557eae502083 in parseSWF_ACTIONRECORD /home/tim/asan/libming/util/parser.c:1124
#2 0x557eae516a85 in parseSWF_INITACTION /home/tim/asan/libming/util/parser.c:2980
#3 0x557eae4e85c3 in blockParse /home/tim/asan/libming/util/blocktypes.c:145
#4 0x557eae4e7ae7 in readMovie /home/tim/asan/libming/util/main.c:269
#5 0x557eae4e8332 in main /home/tim/asan/libming/util/main.c:354
#6 0x7f569f5c4b6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/tim/asan/libming/util/decompile.c:370 in getString
Shadow bytes around the buggy address:
0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
=>0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa
0x0c167fff8030: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c167fff8040: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
0x0c167fff8050: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x0c167fff8060: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x0c167fff8070: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==79668==ABORTING
The text was updated successfully, but these errors were encountered:
./swftocxx $POC
poc.zip
asan output
The text was updated successfully, but these errors were encountered: