heap-buffer-overflow in getString at decompile.c:362

[ZFeiXQ]

./swftoperl POC.zip
poc:POC.zip

  $m->add(new SWF::InitAction(*** buffer overflow detected ***: ../../../SRC/build/bin/swftoperl terminated
[2]    7511 abort      sudo ../../../SRC/build/bin/swftoperl -v swf/samples/bubblewrap.swf

ASAN log

==43948==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000d0ba at pc 0x00000044724a bp 0x7ffef78a3280 sp 0x7ffef78a2a30
WRITE of size 11 at 0x60200000d0ba thread T0
    #0 0x447249 in vsprintf /mnt/d/CLib/llvm-6.0.1/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1572
    #1 0x447576 in __interceptor_sprintf /mnt/d/CLib/llvm-6.0.1/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1615
    #2 0x552631 in getString /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:362:3
    #3 0x555434 in newVar_N /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:725:14
    #4 0x549718 in decompileCALLMETHOD /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:2940:9
    #5 0x53544e in decompileAction /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3360:10
    #6 0x54f493 in decompileActions /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3494:6
    #7 0x54810b in decompileDEFINEFUNCTION /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:2883:3
    #8 0x53535f in decompileAction /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3351:10
    #9 0x54f493 in decompileActions /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3494:6
    #10 0x54f15d in decompile5Action /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3517:2
    #11 0x529c15 in outputSWF_INITACTION /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/outputscript.c:1862:11
    #12 0x523b56 in outputBlock /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/outputscript.c:2083:4
    #13 0x53097e in readMovie /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/main.c:281:4
    #14 0x52eba6 in main /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/main.c:354:2
    #15 0x7f2fbad57b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #16 0x41a389 in _start (/home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/build/bin/swftoperl+0x41a389)

0x60200000d0ba is located 0 bytes to the right of 10-byte region [0x60200000d0b0,0x60200000d0ba)
allocated by thread T0 here:
    #0 0x4da2c0 in malloc /mnt/d/CLib/llvm-6.0.1/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88
    #1 0x5525cb in getString /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:361:5
    #2 0x555434 in newVar_N /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:725:14
    #3 0x549718 in decompileCALLMETHOD /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:2940:9
    #4 0x53544e in decompileAction /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3360:10
    #5 0x54f493 in decompileActions /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3494:6
    #6 0x54810b in decompileDEFINEFUNCTION /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:2883:3
    #7 0x53535f in decompileAction /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3351:10
    #8 0x54f493 in decompileActions /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3494:6
    #9 0x54f15d in decompile5Action /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/decompile.c:3517:2
    #10 0x529c15 in outputSWF_INITACTION /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/outputscript.c:1862:11
    #11 0x523b56 in outputBlock /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/outputscript.c:2083:4
    #12 0x53097e in readMovie /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/main.c:281:4
    #13 0x52eba6 in main /home/zxq/Fuzzing/evaluation/NEWBUILD/libming/SRC_AFL/util/main.c:354:2
    #14 0x7f2fbad57b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/d/CLib/llvm-6.0.1/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1572 in vsprintf
Shadow bytes around the buggy address:
  0x0c047fff99c0: fa fa 00 02 fa fa 00 01 fa fa fd fa fa fa fd fa
  0x0c047fff99d0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff99e0: fa fa 00 02 fa fa fd fa fa fa fd fa fa fa 05 fa
  0x0c047fff99f0: fa fa 07 fa fa fa 00 04 fa fa 00 02 fa fa 05 fa
  0x0c047fff9a00: fa fa 06 fa fa fa 00 03 fa fa 00 02 fa fa 05 fa
=>0x0c047fff9a10: fa fa 00 01 fa fa 00[02]fa fa fa fa fa fa fa fa
  0x0c047fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==43948==ABORTING